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DHS MONITORING OF SOCIAL NETWORKING 
AND MEDIA: ENHANCING INTELLIGENCE 
GATHERING AND ENSURING PRIVACY 


Thursday, February 16, 2012 

U.S. House of Representatives, 

Committee on Homeland Security, 

Subcommittee on Counterterrorism and Intelligence, 

Washington, DC. 

The subcommittee met, pursuant to call, at 10:04 a.m., in Room 
311, Cannon House Office Building, Hon. Patrick Meehan [Chair- 
man of the subcommittee] presiding. 

Present: Representatives Meehan, Cravaack, Quayle, Long, 
Speier, Thompson, and Hahn. 

Mr. Meehan. Good morning. I get to do this, which indicates 
that the Committee on Homeland Security’s Subcommittee on 
Counterterrorism and Intelligence will come to order. 

The subcommittee is meeting today to hear testimony regarding 
tactics that are employed by the Department of Homeland Security 
to monitor social networking and media to enhance intelligence 
gathering, while at the same time protecting privacy. I would like 
to welcome everyone to today’s hearing, and I look forward to hear- 
ing from today’s witnesses on this very, very important issue. 

Over the last year, this subcommittee has had hearings on a 
multitude of terror-related threats, particularly focusing on those 
that have influence on the homeland, including those posed by 
Hezbollah, AQAP, and Boko Haram, to be specific. A common 
theme that has emerged among many of these is the groups’ use 
of social media and networking to recruit, to plan, to plot attacks 
against the homeland or U.S. interests abroad. I emphasize that a 
lot of this was focused on foreign-based websites on which this ac- 
tivity was presumed to be taking place. 

In December, we held a hearing on the terrorists’ use of social 
media. While there was disagreement among the witnesses on the 
effectiveness of that, we do know that terrorists use social media. 
All agreed that terrorist groups used these tools ultimately to their 
advantage. 

However, the use of social media isn’t confined to terrorists. It 
is also a criminal issue and represents an entirely new operating 
space for all sorts of bad actors. I saw it as a Federal prosecutor. 
Social media is now used by individuals who share pictures with 
family and friends, but it is also used by terrorists or other kinds 
of criminals operating everything from frauds to other kinds of bad 
acts. 
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I understand the importance of following leads wherever it may 
take investigators. So if there are leads on a social media or social 
network such as Twitter or Facebook, it may be appropriate to fol- 
low them, so long as the Government activity is consistent with the 
long-standing protections against improper intrusions into pro- 
tected areas of personal privacy. Following leads means collecting 
intelligence, because, ultimately, no terrorism or criminal inves- 
tigation can be effective without good intelligence. I understand 
and support intelligence collection within the rules of the law. 

In addition to following leads, social media provides a forum for 
the Government to have situational awareness of breaking 
events — something I know you spend a great deal of time — terrorist 
attacks, natural disasters — where the Department of Homeland Se- 
curity is responsible for providing real-time situational awareness 
and information sharing across the Federal Government and down 
to the State and local enforcement level, to first responders as well, 
in the event of a terror attack or a natural disaster. For example, 
my good friend on the committee, Mr. Long, who experienced torna- 
does in his district, may have an appreciation of the need for real- 
time communication, sort of the virtual 9—1—1. 

But, conversely, the Government can use tools to communicate 
with people about disasters to enhance situational awareness 
among the citizenry. In these cases, intelligence collection and dis- 
semination is a win-win for the Government and the people. 

But a few weeks ago, it was reported that the Department of 
Homeland Security has instituted a program, and I quote: “to 
produce short reports about threats and hazards using publicly 
available information.” As I said, I support that. However, in what 
I view as something that we have to determine whether it crosses 
the line, these reports also revealed that DHS has tasked analysts 
with collecting intelligence on any media reports, “that reflect ad- 
versely on the U.S. Government and the Department of Homeland 
Security, including both positive and negative reports on FEMA, 
CBP, ICE, among others.” 

In one example, DHS used multiple social networking blogs, in- 
cluding Facebook and Twitter, three different blogs, and reader 
comments in newspapers to capture the reaction of residents to a 
possible plan to bring Guantanamo detainees to a local prison in 
Standish, Minnesota. 

In my view, collecting and analyzing, disseminating private citi- 
zens’ comments could have a chilling effect on individuals’ privacy 
rights and people’s freedom of speech and dissent against their 
Government. I fully recognize that if an individual willingly uses 
Facebook, Twitter, or the comments section of a newspaper 
website, they, in effect, forfeit their right to an expectation of pri- 
vacy. However, other private individuals reading your Facebook 
status updates is different than the Department of Homeland Secu- 
rity reading them, analyzing them, and possibly disseminating and 
collecting them for future purposes. My guess is that the average 
American has no problem with other private individuals reading 
their voluntary on-line writings and postings in open forums but 
may feel a bit of unease knowing the Federal Government may be 
doing the same. 
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I fully recognize these are very complex and nuanced issues, and 
that is why we are holding today’s hearing. I look forward to hear- 
ing from today’s witnesses on how they are collecting intelligence 
to keep us safe and aware, yet also ensuring personal individual 
privacy. 

The Chair now recognizes the Ranking Minority Member of the 
subcommittee, the gentlewoman from California, Ms. Speier, for 
any comments that she may have. 

Ms. Speier. Thank you, Mr. Chairman. I would like to associate 
my comments with yours. I think that they were outstanding and 
really place a good frame on the discussion we are going to have 
today. 

I would also like to thank the witnesses who will be testifying 
today. 

You know, the explosion in the use of social media has changed 
communication as we know it. With just the touch of a button, mil- 
lions of people can post and receive information through Twitter, 
Facebook, blogs, and text messaging in an instant. In just the short 
time that we have been sitting here in this hearing, there have 
been over 3 million comments that have been posted to Facebook 
and a half a million tweets that have been sent. 

Over the past year, we have seen the impact of using social 
media first-hand. Last year, the Arab Spring was driven by 
potesters who organized and communicated largely via social 
media. We have also seen the power of social media here in the 
United States over the past few months as protesters organize via 
Twitter and Facebook for the Occupy Wall Street movements 
throughout the country. We have seen bills before Congress 
stopped in their tracks by the power of social media. 

This growing universe of social networking presents great chal- 
lenges and opportunities to the mission at the Department of 
Homeland Security as it works to keep our Nation safe. Through 
this hearing, we hope to learn how the Department of Homeland 
Security is harnessing the power of social media. Is it possible that 
DHS could use social media to communicate emergency recovery 
and response information to the general public? Can this informa- 
tion be generated quickly? How would such technology have im- 
proved the response to disasters like Hurricane Katrina? What 
about the case of a man-made disaster or a mass evacuation like 
we saw last year in the nuclear meltdown in Japan? Could Twitter 
and instant messaging be used to let people know where to evac- 
uate and what to avoid? 

The vast amounts of publicly available data also present a poten- 
tially great resource for open-source information collection. In 2010, 
we saw alert citizens report suspicious activities in Times Square 
that led to the arrest of Faisal Shahzad. Could similar public re- 
porting be done using social media? How can DHS fully exploit the 
benefits and opportunities of social media without impeding on the 
civil rights and civil liberties of those who choose to use social 
media? Can DHS actively and effectively monitor social media in 
an open and above-board way without being accused of spying on 
lawful activities? 

Last month, the press reported widely on a case where a couple 
from England was prevented from entering the United States be- 
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cause of a tweet. Was this an overreaction? Could or should a mere 
tweet or posting prevent a person from boarding a plane or enter- 
ing the United States? 

I am looking forward to learning from the witnesses exactly how 
DHS uses social media and what DHS is doing to make sure that 
in its use of social media it is not being perceived as being a Big 
Brother. I want to learn from the witnesses what privacy protec- 
tions are in place with regard to DHS’s using social media and how 
the individual components are being trained on these protections. 

Further, I am very interested to find out today how the Depart- 
ment can even handle the sheer volume of open-source postings 
that may be found on any of the various social networking 
websites. Further, if the Department begins to use social media as 
open-source tools, as the Office of Intelligence and Analysis Under 
Secretary has indicated, how will its analysts be trained to con- 
tinue to respect the civil liberties of those that choose to use social 
media? 

Social media could possibly be an integral tool in recognizing and 
preventing emerging threats. However, there has to be some spe- 
cific systems in place that can manage this information while con- 
tinuing to respect civil rights and civil liberties. I look forward to 
hearing what steps are being taken in this area. 

I yield back. 

Mr. Meehan. Thank you, Ranking Member Speier, for your ob- 
servations, which I, as well, share. 

We are also pleased to have in attendance the Ranking Member 
of the committee. The gentleman from Mississippi, Mr. Thompson, 
is with us. As is the custom of the subcommittee where there are 
moments when we are graced with the presence of those Ranking 
and senior members, we give to them the opportunity to make an 
opening statement if they wish. So, at this minute, the Chair would 
recognize Mr. Thompson for any comments that he might have. 

Mr. Thompson. Thank you very much, Mr. Chairman, for your 
gracious introduction. I would like to thank you and the Ranking 
Member for holding this hearing today. I would also like to thank 
the witnesses for their testimony also. 

Social media outlets provide the general public with new avenues 
of discovering, reading, and sharing news, information, and other 
forms of content. With an increasing number of people relying on 
this form of technology as a primary information-gathering re- 
source, social media has supplemented, and in some cases replaced, 
traditional media outlets as a source of news and information. 

Social media allows DHS to quickly and efficiently disseminate 
accurate and useful information to hundreds of thousands of people 
simultaneously. For instance, prior to a natural disaster such as a 
hurricane or a flood, State and local officials can use SMS to con- 
vey evacuation warnings and notices to people living in affected 
areas. After a disaster, the same means can be used to direct peo- 
ple to FEMA. Both the Majority and Minority of this committee 
have a Twitter page. 

I think we all agree that social media outlets are useful. How- 
ever, usefulness alone is not the only criteria we value. Rapid de- 
ployment of accurate information, combined with the ability of the 
average citizen to interact with public officials, will ultimately in- 
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crease DHS’s trust and accountability. To ensure that account- 
ability and trust are embraced as a value, DHS must employ prop- 
er safeguards, including guidelines on information-gathering activi- 
ties and a clear policy on creating a profile or data-mining. If infor- 
mation-gathering activities should occur, clear protocols that ad- 
here to the Constitution and the Privacy Act must be developed to 
direct such activities. The public must be confident that interacting 
with DHS on a website or blog or Facebook will not result in sur- 
veillance or a compromise of Constitutionally-protected rights. 

Further, the use of social media must not replace traditional 
methods of information distribution. When used appropriately, so- 
cial media is an efficient and effective way to communicate with 
people. If used improperly by a Federal agency, public trust and 
confidence will be compromised or forever destroyed. 

Given the high stakes involved, DHS cannot afford to make a 
mistake. I trust that in your efforts to navigate the Department’s 
journey in the world of social media, you will work closely with the 
committee and keep us informed of your activities. We look forward 
to being your GPS. 

With that, I yield back. 

Mr. Meehan. Thank you, Mr. Chairman, for that sense of direc- 
tion. 

We will stop it there. Other Members of the committee are re- 
minded that opening statements may be submitted for the record. 

We are pleased to have a distinguished panel of witnesses before 
us today on this very, very important topic. 

The first is Ms. Mary Ellen Callahan. She was appointed the 
chief privacy officer and the chief Freedom of Information Act offi- 
cer by Department of Homeland Security Secretary Napolitano in 
March 2009. 

Created by Congress in 2002, the Department’s privacy officer is 
the first statutorily mandated privacy office in any Federal agency, 
whose mission is to preserve and enhance privacy protections for 
all individuals, to promote the transparency of Homeland Security 
operations, and to serve as the leader in the Federal privacy com- 
munity. Ms. Callahan is responsible for evaluating Department- 
wide programs, systems, and technologies, and rulemaking for po- 
tential privacy impacts, and for providing mitigation strategies to 
reduce any privacy impact. 

Prior to joining the Department, Ms. Callahan was a partner 
with the law firm of Hogan & Hartson, where she specialized in 
privacy and data security law. She serves as vice chair of the 
American Bar Association’s Privacy and Information Security Com- 
mittee of the Antitrust Division. Now as chief privacy officer, she 
co-chairs both the CIO Council’s Privacy Committee and the Infor- 
mation-Sharing Environment Privacy Guidelines Committee. 

Thank you for being here today, Ms. Callahan. 

I would also like to recognize Mr. Richard Chavez, who is the di- 
rector of Office of Operations Coordination and Planning at the De- 
partment of Homeland Security. 

He provides counsel directly to the Secretary of Homeland Secu- 
rity on a wide range of operational issues, to include prevention, 
protection, mitigation, response and recovery operations, continuity 
of operations, and planning. He leads an office of approximately 
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550 people who are responsible for monitoring the security of the 
United States on a daily basis and providing National situational 
awareness and developing the National common operating picture. 

His office provides vital decision support information to the Fed- 
eral interagency, Governors, homeland security advisors, law en- 
forcement, private-sector, and critical infrastructure operators in 
all States and territories and more than 50 urban major areas Na- 
tion-wide. 

Mr. Chavez has over 30 years of Government experience, serving 
with DHS and the Department of Defense as an Air Force officer 
and a senior civilian in the Office of the Under Secretary of De- 
fense for Policy. 

Before I recognize you for your comments, I have before me on 
the table a report from the Electronic Privacy Information Center. 
I ask unanimous consent to insert in the record a statement from 
EPIC. 

Hearing no objection, so ordered. 

[The information follows:] 

Statement of Marc Rotenberg, President, and Ginger McCall, Staff 
Counsel, The Electronic Privacy Information Center (EPIC) 

Thank you, Mr. Chairman, for the invitation to submit this statement for the 
record for this hearing on “DHS Monitoring of Social Networking and Media: En- 
hancing Intelligence Gathering and Ensuring Privacy” to be held on February 16, 
2012 before the House Subcommittee on Counterterrorism and Intelligence. We ask 
that this statement be included in the hearing record. 

EPIC thanks you and Members of the subcommittee for your attention to this im- 
portant issue. The DHS monitoring of social networks and media organizations is 
entirely without legal basis and threatens important free speech and expression 
rights. Your decision to hold this hearing will help protect important American 
rights. 

The Electronic Privacy Information Center (EPIC) is a non-partisan, public inter- 
est research organization established in 1994 to focus public attention on emerging 
privacy and civil liberties issues. EPIC works to promote Government accountability 
and transparency particularly with respect to activities that implicate Constitu- 
tional rights and fundamental freedoms. EPIC has been analyzing law enforcement 
monitoring of social networks and on-line media for several years. In early 2011, 
EPIC submitted comments to the Department of Homeland Security on the agency’s 
proposal to undertake monitoring of social network and news organizations. 1 EPIC 
has also pursued several Freedom of Information requests to obtain relevant docu- 
ments so that the Members of your committee and the public would have the oppor- 
tunity to meaningful assess the agency’s activities. 

I. EPIC OBTAINED DOCUMENTS THAT REVEAL THAT THE DHS IS MONITORING SOCIAL 

NETWORK AND MEDIA ORGANIZATIONS FOR DISSENT AND CRITICISM OF THE AGENCY 

In April 12, 2011, EPIC submitted a Freedom of Information Act (“FOIA”) request 
to the Department of Homeland Security (“DHS”) seeking agency records detailing 
the media monitoring program. The request sought the following documents: 

• All contracts, proposals, and communications between the Federal Government 
and third parties, including, but not limited to, H.B. Gary Federal, Palantir 
Technologies, and/or Berico Technologies, and/or parent or subsidiary compa- 
nies, that include provisions concerning the capability of social media moni- 
toring technology to capture, store, aggregate, analyze, and/or match personally- 
identifiable information. 

• All contracts, proposals, and communications between DHS and any States, lo- 
calities, Tribes, territories, and foreign governments, and/or their agencies or 
subsidiaries, and/or any corporate entities, including but not limited to H.B. 


1 EPIC, Comments of the Electronic Privacy Information Center to the Department of Home- 
land Security “Systems of Records Notice” DHS-20 11-0003, March 3, 2011, available at: http: I / 
epic.org /privacy / social-media / Comments%20on%20DHS-2011-0003-l.pdf. 



7 


Gary Federal, Palantir Technologies, and/or Berico Technologies, regarding the 
implementation of any social media monitoring initiative. 

• All documents used by DHS for internal training of staff and personnel regard- 
ing social media monitoring, including any correspondence and communications 
between DHS, internal staff and personnel, and/or privacy officers, regarding 
the receipt, use, and/or implementation of training and evaluation documents. 

• All documents detailing the technical specifications of social media monitoring 
software and analytic tools, including any security measures to protect records 
of collected information and analysis. 

• All documents concerning data breaches of records generated by social media 
monitoring technology. 2 

When the agency failed to comply with FOIA’s deadlines, EPIC filed suit on De- 
cember 23, 2011. As a result of this lawsuit, DHS disclosed to EPIC 285 pages of 
documents, including statements of work, contracts, and other agency records re- 
lated to social network and media monitoring. 3 

These documents reveal that the agency had paid over $11 million to an outside 
company, General Dynamics, to engage in monitoring of social networks and media 
organizations and to prepare summary reports for DHS. 4 According to DHS docu- 
ments, General Dynamics will “Monitor public social communications on the inter- 
net,” including the public comment sections of NYT, LA Times, Huff Po, Drudge, 
Wired’s tech blogs, ABC News. 5 DHS also requested monitoring of Wikipedia pages 
for changes 6 and announced its plans to set up social network profiles to monitor 
social network users. 7 

DHS required General Dynamics to monitor not just “potential threats and haz- 
ards,” “potential impact on DHS capability” to accomplish its homeland security 
mission, and “events with operational value,” but also paid the company to 
“Identify!] reports that reflect adversely on the U.S. Government, DHS, or prevent, 
protect, respond or recovery Government activities.” 8 

Within the documents, DHS clearly stated its intention to “capture public reaction 
to major Government proposals.” 9 DHS instructed the media monitoring company 
to generate summaries of media “reports on DHS, Components, and other Federal 
Agencies: Positive and negative reports on FEMA, CIA, CBP, ICE, etc. as well as 
organizations outside the DHS.” 10 

In one DHS-authored document, titled “Social Networking/Media Capability Ana- 
lyst Handbook” the agency presented examples of good summary reports and flawed 
summary reports. One report held up as an exemplar was titled “Residents Voice 
Opposition Over Possible Plan to Bring Guantanamo Detainees to Local Prison- 
Standish MI.” 11 This report summarizes dissent on blogs and social networking 
cites, quoting commenters who took issue with the Obama administration’s plan to 
transfer detainees to the Standish Prison. 

These documents clearly show an agency program that aims to document legiti- 
mate on-line dissent and criticism. The agency has not established any legal basis 
for this program. 

News media reports indicate that the Department of Homeland Security is not the 
only agency engaging in this sort of monitoring. Recent news stories confirm that 


2 EPIC FOIA Request, Apr. 12, 2011, available at: http://epic.org/privacy/socialnet/EPIC- 
FOIA-DHS-Social-Media-Monitoring-04-12-ll.pdf; see also Olivia Katrandjian, DHS Creates Ac- 
counts Solely to Monitor Social Networks, ABC News, Dec. 28, 2011, available at: http:/ / 
abcnews.go.com /US Idhs-creates-fake-accounts-monitor-social-networks / story?id=15247533#.- 
Tzvuu ONS Q3o. 

3 DHS Social Media Monitoring Documents, available at: http://epic.org/foia/epic-v-dhs- 
mediamonitoringlEPlC-F01A-DHS-Media-Monitoring-12-2012.pdf; see e.g. Charlie Savage, Fed- 
eral Contractor Monitored Social Network Sites, The New York Times, Jan. 13, 2012, available 
at: http:/ / www.nytimes.com / 2012 / 01 / 14 / us / federal-security -program-monitored-puhlic-opin- 
ion.html; Jaikumar Vijayan, DHS Media Monitoring Could Chill Public Dissent, EPIC Warns, 
Computerworld Jan. 16, 2012, available at: http: // www.computerworld.com / s / article / 9223441/ 

DHS media monitoring could chill public dissent EPIC warns; Ellen Nakashima, 

DHS Monitoring of Social Media Concerns Civil Liberties Advocates, Washington Post, Jan. 13, 
2012, available at: http:/ / www.washingtonpost.com / world 1 national-security / dhs-monitoring-of- 
social-media-worries-civil-liberties-advocates / 2012/01 / 13 / gIQANP07wP story.html. 

4 EPIC, DHS Social Media Monitoring Documents at 1. 

5 EPIC, DHS Social Media Monitoring Documents at 127, 135, 148, 193. 

6 EPIC, DHS Social Media Monitoring Documents at 124, 191. 

7 EPIC, DHS Social Media Monitoring Documents at 128. 

8 Attachment 1; EPIC, DHS Social Media Monitoring Documents at 51, 195. 

9 EPIC, DHS Social Media Monitoring Documents at 116. 

10 EPIC, DHS Social Media Monitoring Documents at 183, 198. 

11 EPIC, DHS Social Media Monitoring Documents at 118. 
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the Federal Bureau of Investigation has also been developing a similar social net- 
work and media monitoring program. 12 

II. THERE IS NO LEGAL BASIS FOR THE DHS’ SOCIAL NETWORK AND MEDIA MONITORING 

PROGRAM 

The agency has demonstrated no legal basis for its social network and media mon- 
itoring program, which threatens important free speech and expression rights. 

Law enforcement agency monitoring of on-line criticism and dissent chills legiti- 
mate criticism of the Government, and implicates the First Amendment. Freedom 
of Speech and Expression are at the core of civil liberties and have been strongly 
protected by the Constitution and the U.S. courts. 13 Government programs that 
threaten important First Amendment rights are immediately suspect and should 
only be undertaken where the Government can demonstrate a compelling interest 
that cannot be satisfied in other way. 14 Government programs that note and record 
on-line comments, dissent, and criticism for the purpose of subsequent investigation 
send a chilling message to on-line commenters, bloggers, and journalists — “You are 
being watched.” This is truly what George Orwell described in 1984. 

As EPIC has stated in prior comments to DHS, the agency’s social network and 
media monitoring program would also violate the Privacy Act. 15 The Privacy Act re- 
quires agencies to: 

“establish appropriate administrative, technical, and physical safeguards to insure 
the security and confidentiality of records and to protect against any anticipated 
threats or hazards to their security or integrity which could result in substantial 
harm, embarrassment, inconvenience, or unfairness to any individual on whom in- 
formation is maintained.” 16 

The DHS program, as described in the agency’s own documents, would involve col- 
lecting information, including Personally Identifiable Information (“PII”). While the 
agency acknowledges that PII are covered under the Privacy Act and seeks to limit 
some collection, the documents obtained by EPIC also reveal that there are several 
exceptions to the “no PII” rule, including allowances for collection of PII of anchors, 
newscasters, or on-scene reporters who . . . use traditional and/or social media. 17 
This would allow the agency to build files on bloggers and internet activists, in vio- 
lation of the Privacy Act. 

The Privacy Act imposes limitations on the dissemination of personal information 
collected by an agency. As EPIC has noted in its comments the DHS, the agency’s 
social network and media monitoring program permits the collection and disclosure 
of information that contravenes the text and purpose of the Privacy Act. 18 DHS has 
indicated that it plans to regularly relay the records to Federal, State, local, Tribal, 
territorial, foreign, or international government partners. 19 The DHS Chief Privacy 
Officer (“CPO”) has stated that the records would be transferred both by “email and 
telephone” to contacts inside and outside of the agency. 20 The CPO has also stated 


12 Marcus Wohlson, FBI Seeks Digital Tool to Mine Entire Universe of Social Media, Chicago 
Sun Times, Associated Press, Feb. 12, 2012, available at: http: II www.usatoday.com /USCP / 
PNI / Nation / World! 20 12-02 13-PNI0213wir-FBI-social-media ST U.htm. 

13 See e.g. United States v. Stevens, 130 S. Ct. 1577, 1585, 176 L. Ed. 2d 435 (2010) (holding 
that the “First Amendment itself reflects a judgment by the American people that the benefits 
of its restrictions on the Government outweigh the costs”). 

14 See e.g. NAACP v. Button, 83 S.Ct. 328 (1963); Citizens United v. Fed. Election Comm’n, 
130 S. Ct. 876 (2010). 

15 EPIC, Comments of the Electronic Privacy Information Center to the Department of Home- 
land Security “Systems of Records Notice” DHS-2011-0003, March 3, 2011, available at: http :/ / 
epic.org / privacy / social.media / Comments%20on%20DHS-201 1-0003-1 .pdf. 

16 5 U.S.C. §552a(e)(10) (2010). 

17 DHS Social Media Monitoring Documents at 107. 

18 EPIC, Comments of the Electronic Privacy Information Center to the Department of Home- 
land Security “Systems of Records Notice” DHS-2011-0003, March 3, 2011, available at: http:! / 
epic.org / privacy / social.media / Comments%20on%20DHS-201 1-0003-1 .pdf. 

19 EPIC, Comments of the Electronic Privacy Information Center to the Department of Home- 
land Security “Systems of Records Notice” DHS-2011-0003, March 3, 2011, available at: http:! / 
epic.org /privacy /social.media/ Comments%20on%20DHS-2011-0003-l.pdf; DHS Social Media 
Monitoring Documents at 139, 207. 

20 Department of Homeland Security, Privacy Impact Assessment for the Office of Operations 
Coordination and Planning Publicly Available Social Media Monitoring and Situational Aware- 
ness Initiative, 8, Jan. 6, 2011. 
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that “[n]o procedures are in place” to determine which users may access this system 
of records . 21 

DHS’ program also fails to comply with Privacy Act requirements that agencies 
make “reasonable efforts to assure that records are accurate, complete, timely, and 
relevant for agency purposes” prior to their dissemination outside of the Federal 
Government. DHS has readily admitted that its social media monitoring initiative 
explicitly relies on unverified sources of information to construct the records that 
DHS will then disseminate to State, local, Tribal, territorial, foreign, or inter- 
national government partners. As the DHS CPO has stated, “[u]sers may acciden- 
tally or purposefully generate inaccurate or erroneous information. There is no 
mechanism for correcting this .” 22 The agency unlawfully shifts responsibility for 
verifying the agency’s information onto the social media users the agency plans to 
follow: “the community is largely self-governing and erroneous information is nor- 
mally expunged or debated rather quickly by others within the community with 
more accurate and/or truthful information .” 23 

As EPIC has previously stated in comments to DHS, the collection of information 
about individuals obtained from social networks and the monitoring of media orga- 
nizations falls outside of the agency’s statutory authority. The agency has failed to 
cite any statutory provision that would indicate that Congress gave the DHS au- 
thority to engage in intelligence collection, let alone to violate the Constitutional 
rights of individuals using the internet to express criticisms of the agency or the 
U.S. Government. In fact, the one statutory provision cited by the agency only al- 
lows the DHS Secretary to “access, receive, and analyze law enforcement informa- 
tion, intelligence information, and other information from agencies of the Federal 
Government, State and local government agencies and private sector entities.” (Em- 
phasis added). It does not authorize the agency to initiate a program to gather or 
collect that information itself. The only relevant provision that does mention gath- 
ering narrows the term to “incident management decision making.” 

Hence, DHS’ monitoring and gathering of social network and media information 
is not within the agency’s delegated duties. DHS monitoring of stories or individuals 
that “report adversely” on the agency (or the Government more broadly) is even fur- 
ther outside of its delegated duties. The agency has failed to establish any legal 
basis for this program . 24 

hi. epic’s recommendations 

The problems described above are significant and far-reaching. An agency that 
was established to help protect the United States against future foreign attacks is 
now deploying its significant resources to monitor political opposition and the work 
of journalists within the United States. It has no legal basis to do so, and in pur- 
suing the monitoring of social networks and media organizations for activities that 
“reflect adversely” on the agency and the U.S. Government, it has transformed its 
purpose from protecting the American public to protecting simply itself. 


21 Department of Homeland Security, Privacy Impact Assessment for the Office of Operations 
Coordination and Planning Publicly Available Social Media Monitoring and Situational Aware- 
ness Initiative, 10, June 22, 2010, DHS Social Media Monitoring Documents at 156, 145. 

22 DHS Social Media Monitoring Documents at 156, 145. 

23 DHS Social Media Monitoring Documents at 156, 145. 

24 The Attorney General has established elaborate Guidelines for domestic investigations. The 
Attorney General Guidelines for Domestic FBI Investigations, available at www.justice.gov / ag / 
readingroom / guidelines.pdf While EPIC does not necessarily endorse the standards set out in 
the DIOG, we note that they require at a minimum a predicate that justifies a Federal inves- 
tigation. Expressing criticism of the Government or a particular Federal agency alone can sim- 
ply never be the basis for a Federal investigation under the Attorney General Guidelines. 

Circumstances Warranting Investigation 

A predicated investigation may be initiated on the basis of any of the following cir- 
cumstances: 

a. An activity constituting a Federal crime or a threat to the National security has 
or may have occurred, is or may be occurring, or will or may occur and the investigation may 
obtain information relating to the activity or the involvement or role of an individual, group, 
or organization in such activity. 

b. An individual, group, organization, entity, information, property, or activity is or 
may be a target of attack, victimization, acquisition, infiltration, or recruitment in connection 
with criminal activity in violation of Federal law or a threat to the National security and the 
investigation may obtain information that would help to protect against such activity or threat. 

c. The investigation may obtain foreign intelligence that is responsive to a foreign in- 
telligence requirement. 

Id. at 21. See, generally, EPIC, “The Attorney General Guidelines,” available at http :/ / 
epic.org/privacy/fbi/ 
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We specifically recommend that the subcommittee take the following steps to ad- 
dress the immediate risks to Constitutional liberty: 

• Require that the DHS immediately and permanently cease the practice of moni- 
toring social networks and media organizations for the purpose of identifying 
political and journalistic activities that “reflect adversely” on the agency or the 
Federal Government. 

• Require that the DHS suspend the social network and media organization moni- 
toring program until safeguards are put into place which will ensure oversight, 
including annual reporting requirements. 

• Require that other agencies, including the Federal Bureau of Investigation, 
which have developed or are in the process of developing similar programs pro- 
vide publicly available, annual reports to Congress that set out in the detail the 
legal standard for this activity and describe how Constitutional rights will be 
safeguarded. 


IV. CONCLUSION 

EPIC respectfully requests that the subcommittee take the steps outlined in this 
statement, including requiring the immediate and permanent end to DHS’ practice 
of monitoring for dissent; adopting guidelines for greater oversight of the DHS’ so- 
cial network and media monitoring program, and imposing the same oversight re- 
quirements on similar social network and media monitoring programs at other agen- 
cies. 

Thank you for your consideration of our views. We would be pleased to provide 
any further information the Committee requests. 

Mr. Meehan. Now, for all panelists, I know you gave us some de- 
tailed testimony in written form. If you could do your best to sum- 
marize your submitted testimony, we would appreciate that. 

I now welcome back Ms. Callahan and recognize her first for her 
testimony. 

Thank you. 

STATEMENT OF MARY ELLEN CALLAHAN, CHIEF PRIVACY 
OFFICER, DEPARTMENT OF HOMELAND SECURITY 

Ms. Callahan. Thank you very much, sir. 

Good morning. Chairman Meehan, Ranking Member Speier, 
Ranking Member Thompson, and Members of the committee, thank 
you for this opportunity to discuss the Department of Homeland 
Security’s uses of social media and the privacy protections my office 
has embedded into all of these uses. 

As described in our written testimony, communications and so- 
cial media provide important benefits to the American public and 
to the Department. With that said, as the Chairman and the Rank- 
ing Member acknowledged, there is a great deal of personal infor- 
mation that, although publicly available, is not necessary for the 
Department to see or use. 

Let me be clear: DHS recognizes the use of social media by Gov- 
ernment actors must occur with appropriate privacy, civil rights, 
and civil liberties protections. For this reason, DHS has created De- 
partment-wide standards designed to protect privacy in each cat- 
egory of its use. 

There are essentially three uses of social media by the Depart- 
ment of Homeland Security: First, external communications and 
outreach between the Department and the public; second, aware- 
ness of breaking news and events and situations related to home- 
land security, known as situational awareness; and third, when 
DHS has the appropriate authorities to use social media for oper- 
ational use such as law enforcement and investigations. In each 
category, the Department has established standards that are de- 
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signed to incorporate privacy protections ex ante, to create uniform 
standards across the components and Department, and to be trans- 
parent about the scope of our activities. 

The Department utilizes the opportunity social networking pre- 
sents to provide the public with robust information. For example, 
DHS has a presence on many of the major social networking plat- 
forms. FEMA, of course, is well-known for utilizing social media ef- 
fectively for education and in emergencies. 

DHS established Department-wide standards for use of social 
media for communications and outreach purposes through the de- 
velopment and publication of two Privacy Impact Assessments, 
known as PIAs. All DHS profiles and communications via social 
media must adhere to these PIAs. 

As my colleague Mr. Chavez will describe, the Office of Oper- 
ations Coordination and Planning has a statutory responsibility to 
provide situational awareness and establish a common operating 
picture for the Federal Government. The Privacy Office and Oper- 
ations work together closely and develop detailed standards and 
procedures associated with reviewing social media, launched three 
pilots, and then did a privacy compliance review of those pilots. To- 
gether, the National Operations Center and the Privacy Office de- 
signed a holistic set of privacy protections to be implemented when- 
ever social media is being reviewed for situational awareness, and 
then memorialized them in a publicly available PIA in June 2010. 

Several months later, as part of a mandated privacy compliance 
review, my office determined that the PIA should be updated to 
allow for the collection and dissemination of personally identifiable 
information in a very limited number of situations. After January 
2011, limited personally identifiable information on a few cat- 
egories of individuals may be collected only when it lends credi- 
bility to the report or facilitates coordination. The categories are es- 
sentially: Public figures who make public statements or are part of 
an event; or people who are in potential life-or-death cir- 
cumstances. 

The first weekend that personally identifiable information was 
allowed to be collected and disseminated was the weekend that 
Congresswoman Giffords was shot in Arizona. Learning imme- 
diately who was the impacted Member of Congress was very useful 
for the Department, for the Federal Government, and facilitated 
rapid coordination. 

There may also be situations where particular programs within 
the Department or its components may need to access material on 
social media or individual profiles in support of authorized mis- 
sions such as law enforcement. Given the breadth of the Depart- 
ment’s mission and the fact that access, collection, and use of social 
media or other publicly available information is governed by spe- 
cific legal authorities rather than Department-wide standards, the 
Department takes a different approach to embedding privacy pro- 
tections into this type of social media, implementing privacy protec- 
tions through a policy and management directive. 

The Department is finalizing a management directive for privacy 
protections in the operational use of social media, which will sys- 
tematize the previous component policies, be enforceable through- 
out the Department, and will identify the authorities, restrictions, 
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and privacy oversight related to the use of social media for oper- 
ational purposes. The directive will also provide instructions on 
how to embed privacy protections into the operational use of social 
media and in each investigation performed by Departmental per- 
sonnel. Essentially, the standard is, if you can’t do it off-line, you 
can’t do it on-line. 

In light of the scope and availability of information, including 
personal information, found in social media, the Privacy Office in- 
tends to continue to monitor the Department’s use of social media 
in all three categories. The Department has established a com- 
prehensive compliance regime. It is every employee’s responsibility 
to adhere to those standards, and the Privacy Office will seek to 
confirm that compliance in order to protect the public’s trust in the 
Department’s use of social media. 

Thank you, sir. 

[The joint statement of Ms. Callahan and Mr. Chavez follows:] 

Joint Prepared Statement of Mary Ellen Callahan and Richard Chavez 

Chairman Meehan, Ranking Member Speier, and Members of the subcommittee, 
we appreciate the opportunity to be here today to discuss the Department of Home- 
land Security’s (DHS) use of social media, and the privacy protections the DHS Pri- 
vacy Office has put into place. 

Social media are web-based and mobile technologies that turn communication into 
an interactive dialogue in a variety of on-line fora. It may be appropriate for the 
Government, including DHS, to use social media for a variety of reasons. The Presi- 
dent has challenged his administration to use technology and tools to create a more 
efficient, effective, and transparent Government. 1 DHS recognizes that the use of so- 
cial media by Government actors must occur with appropriate privacy, civil rights, 
and civil liberties protections; whether DHS is disclosing its information and press 
releases via social media platforms like Twitter and Facebook, reviewing news feeds 
for situational awareness, or researching identified, discrete targets for legitimate 
investigatory purposes. Accordingly, DHS has created Department-wide standards 
designed to protect privacy, civil rights, and civil liberties in each category of its use. 

There are three general ways in which DHS utilizes social media, and each has 
associated privacy protections: 

• External communications and outreach between the Department and the public; 

• Awareness of breaking news of events or situations related to homeland secu- 
rity, known as “situational awareness;” and 

• Operational use, when DHS has the appropriate authorities, such as law en- 
forcement and investigations. 

In each category, the Department has established and enforces standards that in- 
corporate privacy protections ex ante, create uniform standards across the compo- 
nents and Department, and are transparent with regard to the scope of our activi- 
ties. 


EXTERNAL communications and outreach 

Consistent with the President’s 2009 Memorandum on Transparency and Open 
Government, the Office of Management and Budget’s (OMB) Open Government Di- 
rective 2 and OMB’s Memorandum M-10-23, Guidance for Agency Use of Third- 
Party Websites and Applications, 3 the Department uses the social networking me- 
dium to provide the public with robust information through many channels. For ex- 
ample, DHS currently has a presence on many of the major social networking plat- 
forms, including Facebook, Twitter, and YouTube. In addition, FEMA launched a 
FEMA app for smartphones that contains preparedness information for different 
types of disasters. Similarly, the Transportation Security Administration has 
MyTSA Mobile Application, which enables the traveling public access to relevant 


1 President Barack Obama, Memorandum on Transparency and Open Government (January 

21, 2009), available at http : / / www.gpoaccess.gov / presdocs/ 2009 IDCPD200900010.pdf; OMB 
Memorandum M-10— 06, Open Government Directive (December 8, 2009), available at http :/ / 
www.whitehouse.gov/omb / assets / memoranda 201 0 / ml0-06.pdf. 

2 See supra note 1. 

3 http: l 1 www. whitehouse.gov/sites / default / files /omb / assets / memoranda 201 01 ml 0-23.pdf. 
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TSA travel information, such as types of items that may be carried through TSA 
security checkpoints, or estimated wait times. 

In 2009, the Department established a Social Media Advisory Group, with rep- 
resentatives from the Privacy Office; Office of General Counsel; Chief Information 
Security Officer; Office of Records Management; and Office of Public Affairs to en- 
sure that a variety of compliance issues including privacy, legal, security, and 
records management issues are addressed as DHS uses social media. This group 
governs and provides guidance on social media initiatives related to external com- 
munications and public outreach by reviewing recommendations from Components 
and offices and evaluating Terms of Service agreements and Terms of Use policies. 
The group also developed a social media use plan, while working to ensure compli- 
ance issues are addressed and resolved before the first Department use of a par- 
ticular application of social media. 

DHS also established Department-wide standards for use of social media for com- 
munications and outreach purposes through the creation, and development of, two 
Privacy Impact Assessments (PIAs). The PIAs address two types of uses of social 
media within the communications/outreach category: (1) Interactive platforms where 
the Department has official identities, using those profiles to provide information 
about the Department and its services, while having the ability to interact with 
members of the public such as allowing them to post comments on the official De- 
partment page or profile; 4 and (2) unidirectional social media applications encom- 
passing a range of applications, often referred to as applets or widgets, that allow 
users to view relevant, real-time content from predetermined sources, such as 
podcasts, Short Message Service (SMS) texting, audio and video streams, and Really 
Simple Syndication (RSS) feeds. 5 

The PIAs analyze the Department’s use of social media and networking for com- 
munications purposes, if and how these interactions and applications could result 
in the Department receiving personally identifiable information (PII), and the pri- 
vacy protections in place. The PIAs describe the information the Department may 
have access to, how it will use the information, what information is retained and 
shared, and how individuals can gain access to and correct their information. For 
example, official DHS accounts across social media and networking websites and ap- 
plications must be identified by the component or Department seal as well as an 
anonymous, but easily identifiable user name account displaying a DHS presence, 
such as “DHS John Q. Employee.” Both the communications and outreach PIAs also 
include periodically-updated appendices that identify the specific Department-ap- 
proved profiles and applications. In addition, the PlAs contain provisions that De- 
partment-approved profiles are subject to Privacy Compliance Reviews by the DHS 
Privacy Office. 


SITUATIONAL AWARENESS 

The Office of Operations Coordination and Planning (OPS), National Operations 
Center (NOC), has a statutory responsibility (Section 515 of the Homeland Security 
Act (6 U.S.C. §321d(b)(l))) to provide situational awareness and establish a common 
operating picture for the Federal Government, and for State, local, Tribal govern- 
ments as appropriate, in the event of a natural disaster, act of terrorism, or other 
man-made disaster, and (2) ensure that critical terrorism and disaster-related infor- 
mation reaches Government decision-makers. Traditional media sources, and more 
recently social media sources, such as Twitter, Facebook, and a vast number of 
blogs, provide public reports on breaking events with a potential nexus to homeland 
security. By examining open-source traditional and social media information, com- 
paring it with many other sources of information, and including it where appro- 
priate into NOC reports, the NOC can provide a more comprehensive picture of 
breaking or evolving events. To fulfill its statutory responsibility to provide situa- 
tional awareness and to access the potential value of the public information within 
the social media realm, in 2010, the NOC launched the first of three pilots using 
social media monitoring related to specific natural disasters and international 
events. 

Beginning with the pilots, the reason the NOC utilizes social media tools is to 
identify breaking or evolving incidents and events to provide timely situational 
awareness and establish a more complete common operating picture. The NOC 
views information from a variety of sources to include open-source reporting and a 


4 http: / / www.dhs.gov / xlibrary / assets / privacy / privacy pia-dhs socialnetworkinginter- 

actions.pdf. 

5 http: / / www.dhs.gov / xlibrary / assets / privacy / privacy pia dhswide unidirectionalsocial- 

media.pdf 
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variety of public and Government sources. The NOC synthesizes these reports for 
inclusion in a single comprehensive report. These reports are then disseminated to 
DHS components, interagency partners, and State, local, Tribal, territorial, and pri- 
vate-sector partners with access to the NOC’s common operating picture. The con- 
tent of the reports may be related to standing critical information requirements, 
emerging events potentially affecting the homeland, or special events such as the 
Super Bowl or the United Nations General Assembly. 

Prior to implementing each social media pilot, the Privacy Office and the Office 
of Operations Coordination and Planning developed detailed standards and proce- 
dures associated with reviewing information on social media websites. These stand- 
ards and procedures are documented through a series of pilot-specific PIAs. 6 

The NOC pilots occurred during the 2010 Haiti earthquake response, the 2010 
Winter Olympics in Vancouver, British Columbia; and the response to the April 
2010, Deepwater Horizon Gulf Coast oil spill. For each of these pilots, the NOC uti- 
lized internet-based platforms to provide situational awareness and develop a com- 
mon operating picture directly related to the response, recovery, and rebuilding ef- 
forts in Haiti by reviewing information on publicly-available on-line fora, blogs, pub- 
lic websites, and message boards. 

Following the three discrete social media monitoring pilots by the NOC, the Pri- 
vacy Office did a thorough (and public) Privacy Compliance Review of the NOC’s im- 
plementation of the PlAs’ privacy protections. 7 The Privacy Office’s review found 
that the NOC’s social media monitoring activities did not collect PII, did not monitor 
or track individuals’ comments, and complied with the stated privacy parameters set 
forth in the underlying PIAs. 

Given the positive assessment of the three pilots, OPS and the Privacy Office de- 
signed a holistic set of privacy protections to be implemented whenever information 
made available through social media is being reviewed for situational awareness 
and establishing a common operating picture. In June 2010, the Department re- 
leased its Publicly Available Social Media Monitoring and Situational Awareness 
Initiative PIA, incorporating these protections. 8 This PIA describes how the NOC 
uses internet-based platforms that provide a variety of ways to review information 
accessible on publicly-available on-line fora, blogs, public websites, and message 
boards. Through the use of publicly-available search engines and content 
aggregators, the NOC reviews information accessible on certain heavily-trafficked 
social media sites for information that the NOC can use to provide situational 
awareness and establish a common operating picture, all without monitoring or 
tracking individuals’ comments or relying on the collection of PII, with very narrow 
exceptions, discussed below. 

The NOC does not: (1) Actively seek PII except for the narrow exceptions; (2) post 
any information on social media sites; (3) actively seek to connect with internal/ex- 
ternal social media users; (4) accept internal/external personal users’ invitations to 
connect; or (5) interact on social media sites. The NOC is, however, permitted to es- 
tablish user names (consistent with the criteria established in the communications 
and outreach PIAs) and passwords to form profiles and follow relevant Government, 
media, and subject matter experts on social media sites as described in the June 
2010 PIA; and to use search tools under established criteria and search terms that 
support situational awareness and establishing a common operating picture. 

As part of the publication of the June 2010 PIA, the Privacy Office mandates Pri- 
vacy Compliance Reviews every 6 months. After conducting the second Privacy Com- 
pliance Review, the Privacy Office determined that this PIA should be updated to 
allow for the collection and dissemination of PII in a very limited number of situa- 
tions in order to respond to the evolving operational needs of the NOC. After Janu- 
ary 2011, this PII on the following categories of individuals may be collected when 
it lends credibility to the report or facilitates coordination with Federal, State, local, 
Tribal, territorial, and foreign governments, or international law enforcement part- 
ners: 


6 The NOC and the Privacy Office developed three PIAs in the pilot stage of the NOC Media 
Monitoring Initiative: Haiti Social Media Disaster Monitoring Initiative, January 21, 2010, 

available at http: / lwww.dhs.gov /xlibrary / assets ! privacy /privacy via ops haiti.pdf; 2010 

Winter Olympics Social Media Event Monitoring Initiative February 10, 2010, available at 

http: / / www.dhs.gov / xlibrary / assets / privacy / privacy via ops 201 Owinterolympics.pdf; and 

April 2010 BP Oil Spill Response Social Media Event Monitoring Initiative, April 29, 2010, avail- 
able at http .7 / www.dhs.gov / xlibrary / assets / privacy ! privacy pia_ops bpoilspill.pdf. 

7 http:/ / www.dhs.gov / xlibrary / assets / privacy / privacy-privcomrev-ops-olympicsandhaiti.pdf '. 

Three Privacy Compliance Reviews have been completed and published by the Privacy Office, 
available at: http:/ / www.dhs.gov / files / publications / gc 1284657535855. shtm. 

* http: / / www.dhs.gov / xlibrary / assets / privacy / privacy via ops publiclyavailablesocial- 

media.pdf 
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(1) U.S. and foreign individuals in extremis, i.e., in situations involving potential 
life or death circumstances; 

(2) Senior U.S. and foreign government officials who make public statements or 
provide public updates; 

(3) U.S. and foreign government spokespersons who make public statements or 
provide public updates; 

(4) U.S. and foreign private-sector officials and spokespersons who make public 
statements or provide public updates; 

(5) Names of anchors, newscasters, or on-scene reporters who are known or 
identified as reporters in their posts or articles, or who use traditional and/or 
social media in real time to provide their audience situational awareness and 
information; 

(6) Current and former public officials who are victims of incidents or activities 
related to homeland security; and 

(7) Terrorists, drug cartel leaders, or other persons known to have been involved 
in major crimes of homeland security interest, (e.g., mass shooters such as those 
at Virginia Tech or Ft. Hood) who are killed or found dead. 9 

For this narrow category of individuals, DHS may only collect the full name, affili- 
ation, position or title, and publicly-available user ID, when it lends credibility to 
the report. DHS determined that this information improves the efficacy and effec- 
tiveness of the social media monitoring initiative without an unwarranted invasion 
of privacy of individuals in each of these categories. For this narrow category of indi- 
viduals the PII is only stored in the narrative report in which it is used, and is not 
tracked for any other reason. DHS published a System of Records Notice 10 that de- 
scribes the creation of these seven exceptions for the collection of PII and narrowly 
tailored, how much information can be collected, and how the information can be 
used. Furthermore, the Privacy Office is commencing its semi-annual Privacy Com- 
pliance Review in late February to ensure that the NOC continues to adhere to the 
privacy protections identified in the PIA. 

OPERATIONAL USE 

There may be situations where particular programs within the Department or its 
components may need to access material on social media or individual profiles in 
support of authorized missions. Given the breadth of the Department’s mission, and 
the fact that access, collection, and use of social media and other publicly-available 
information is governed by specific legal authorities, rather than Department-wide 
standards, the Department has taken a different approach in embedding privacy 
protections into Department use of social media for operational purposes, with au- 
thority-based requirements implemented through policy and Management Direc- 
tives. For example, components of DHS such as U.S. Customs and Border Protec- 
tion, U.S. Immigration and Customs Enforcement, Federal Protective Service, Fed- 
eral Air Marshals Service, U.S. Coast Guard, and U.S. Secret Service have the au- 
thority to engage in law enforcement activities which may include the use of on-line 
and internet materials. Other DHS offices and components may be authorized to 
utilize social media for specific law enforcement purposes such as investigating 
fraud. The Office of Intelligence and Analysis also has some overt collection authori- 
ties for intelligence purposes which may include the use of on-line and internet ma- 
terials. 

DHS has established objective criteria by which those investigatory components 
can access publicly-available information. DHS components cannot review individ- 
uals’ information unless they have appropriate underlying authority and supervisory 
approval. Moreover, Office of Operations Coordination and Planning and Office of 
Intelligence and Analysis have additional specific policies on the use of social media 
for operational purposes. One of DHS’ responsibilities is to confirm our work is 
being done under the appropriate legal framework for Federal law enforcement ac- 
tivities. However, with increased access to individuals’ personal information posted 
on the internet and social media sites, these DHS components have been reminded 
that they must also be conscious of privacy considerations. 

At DHS, we work every day to strike a balance between our need to use open- 
source internet and social media information for all purposes, but particularly law 
enforcement and investigatory purposes to further our mission, while protecting 
First Amendment rights, Fourth Amendment rights, and privacy. 


9 The most recent PIA update (authorizing these narrow PII categories collection) was final- 

ized January 6, 2011, and is available at: http://www.dl is.gov I xiibrary I assets I privacy I pri- 
vacy via ops publicly availablesocialmedia update.pdf. 

10 http: II edocket.access.gpo.gov / 2011 / 2011-2198.htm. 
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In 1999, the Department of Justice issued guidelines for Federal law enforcement 
agents that outline on-line investigative principles that are applicable, but do not 
explicitly reference, social media. In 2011, the Office of the Director of National In- 
telligence issued guidelines that outline how intelligence community professionals 
should use technology, including social media. Both guidelines address the following 
topics: Obtaining information from publicly-available media under the same condi- 
tions that apply to obtaining information from other sources generally open to the 
public; passively observing and logging real-time electronic communications on 
media open to the public under the same circumstances in which these activities 
could be undertaken when attending a public meeting; and retaining the contents 
of a stored electronic message, such as on-line traffic, if that information would have 
been retained had it been written on paper. Moreover, Federal law enforcement 
agents communicating on-line with witnesses, subjects, or victims must disclose 
their affiliation with law enforcement when DHS guidelines would require such dis- 
closure if the communication were taking place in person or over the telephone — 
they may communicate on-line under a non-identifying name or fictitious identity 
if DHS guidelines and procedures would authorize such communications in the 
physical world. 11 Finally, Federal law enforcement agents may not access restricted 
on-line sources absent legal authority permitting entry into a private space. Until 
a Department-wide Management Directive on using social media for operational 
purposes is finalized, the Secretary has instructed all components to adhere to the 
DOJ or ODNI guidelines as appropriate. 

In light of the varying authorities and responsibilities within the Department, in- 
stead of having a Privacy Impact Assessment with general standards (such as for 
communications and situational awareness purposes), the Department is developing 
a Management Directive for Privacy Protections in Operational Use of Social Media. 
The Management Directive will be enforceable throughout the Department, and will 
identify the authorities, restrictions, and privacy oversight related to use of social 
media for operational purposes. The Management Directive will also provide in- 
structions on how to embed privacy protections into the operational use of social 
media and each investigation performed by Department personnel. The Privacy Of- 
fice has already investigated one component’s use of social media for investigatory 
purposes; its conclusions are informing the Management Directive. 

Consistent with the Department’s approach to embed privacy protections through- 
out the life cycle of Department activities, the Privacy Office will conduct a Privacy 
Compliance Review or assessment of the Department’s adherence to the social 
media Management Directive approximately 6 months after the Directive is imple- 
mented. 


CONCLUSION 

In light of the scope and availability of information including PII found in social 
media venues, the Privacy Office intends to continue to monitor the Department’s 
use of social media in all three categories — communications and outreach, situa- 
tional awareness, and operational use — to ensure privacy protections are built-in 
and followed. 

Mr. Meehan. Thank you, Ms. Callahan. 

Now I recognize Mr. Chavez for his testimony. 

STATEMENT OF RICHARD CHAVEZ, DIRECTOR, OFFICE OF OP- 
ERATIONS COORDINATION AND PLANNING, DEPARTMENT 

OF HOMELAND SECURITY 

Mr. Chavez. Good morning, Chairman Meehan, Ranking Mem- 
ber Speier, and Members of the subcommittee. I also would like to 
thank you for inviting me here today to talk to you about the Na- 
tional Operations Center use of social media monitoring to provide 
real-time or near-real-time situational awareness of potential oc- 
curring events or incidents that may impact the safety, security, 
and resilience of the homeland. 


11 See, e.g., On-line Investigative Principles for Federal Law Enforcement Agents (Department 
of Justice, 1999) and Civil Liberties and Privacy Guidance for Intelligence Community Profes- 
sionals: Properly Obtaining and Using Publicly Available Information (Office of the Director of 
National Intelligence, 2011). 
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As stated in Section 515 of the Homeland Security Act, as 
amended, the National Operations Center is the principal oper- 
ations center for the Department of Homeland Security and shall 
provide situational awareness and a common operating picture for 
the entire Federal Government and for State, local, and Tribal gov- 
ernments as appropriate in the event of a natural disaster, act of 
terrorism, or other man-made disaster, and ensure that critical ter- 
rorism and disaster-related information reaches Government deci- 
sion-makers. 

In order to fulfill these statutory responsibilities, the National 
Operations Center, also known as the NOC, gathers reports from 
multiple sources, to include open-source media reporting. Media re- 
porting is often the first indication of a potential incident. For this 
reason, the NOC utilizes and incorporates media reporting into its 
incident reports. The primary focus of our reporting is on what is 
happening, and not who is reporting the event. 

As previously stated, the NOC gathers reports from a variety of 
sources and synthesizes them into one single comprehensive inci- 
dent report that is distributed again to the DHS leadership, DHS 
components, and other Federal, State, local, Tribal, territorial, and 
non-governmental and private-sector partners for action as appro- 
priate. 

The after-action assessments relating to the Government’s re- 
sponse during Hurricane Katrina highlighted the importance of 
real- and near-real-time information from media reporting to en- 
able a more timely response during a dynamic catastrophic event. 
In 2006, following Hurricane Katrina, the NOC began assessing 
the incorporation of media reporting for major media networks into 
incident reports to provide responders with real-time information. 
To date, incorporating media reporting into the NOC’s incident re- 
ports has enabled our partners to have greater awareness during 
events and incidents. 

Here is a real-world example of how the NOC incorporates media 
reporting. In early January 2012, the media in Charlotte, North 
Carolina, was first on scene reporting damage after severe weather 
erupted across multiple counties near Charlotte. The media reports 
were combined with reporting from State and local sources. The 
end result, again, was a more timely incident report that provided 
specific and comprehensive information to our partners, enabling 
them to make informed decisions. 

The NOC incorporates media reporting into incidents across the 
full spectrum of Homeland Security operations: Prevent and pro- 
tect, respond and recover. 

Another real-world example of how NOC incorporates media re- 
porting into its incident reports also occurred in early January 
2012. The incident occurred in Austin, Texas. The media in Austin 
posted incident information about evacuation of a high school after 
a suspicious device was seen in a vehicle on campus. The media re- 
ported that, according to county sheriffs office spokesmen, sheriffs 
deputies were responding to an explosive device in a car. Through 
additional Government reporting, the NOC learned that the scene 
was secured and that no explosive device was found by law enforce- 
ment officials. 
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Again, I would like to emphasize that it is the “what,” not the 
“who,” that is relevant for NOC reporting purposes. The NOC ad- 
heres to strict enforcement of privacy guidelines with regard to 
media reports. The NOC, in coordination with the DHS Office of 
Privacy, evaluates processes and incident reports on a recurring 
basis to ensure our privacy guidelines are being complied with. 

Again, thank you for the opportunity to speak with you today, 
and I am happy to answer any questions you may have. 

Mr. Meehan. Well, thank you for your testimony, Mr. Chavez. 

As I said in my opening statement, I am concerned about some 
of the news reports and materials related to DHS monitoring of so- 
cial media and the networks. So I will now recognize myself for a 
few minutes of questioning. 

The testimony has been revealing in the sense of giving us the 
overall perspective. I think all of us appreciate the ability for the 
Governmental entities to broadcast through the various pieces so 
people know about what you are doing. 

Mr. Chavez, you talked a lot about, sort of, media monitoring. 
There is an expectation on the part of many of those who are re- 
porters and otherwise, they know they are putting their product 
out so that it can be reviewed. So I think we can go past those 
kinds of things. 

We also appreciate, as I said in my opening statement, about the 
opportunity to avail ourselves in real time of breaking information 
that can be communicated in certain ways that are now available 
so that there is the ability to keep those that need to make the de- 
cisions up on the latest information. 

But you are sensitive — we are here today because where we are 
trying to find is where that line is where the public citizen — it is 
not just the expectation of privacy, because we know they are com- 
municating in public fora or even quasi-public fora. But we are 
talking now about monitoring on-line information in blogs, in 
websites, in message boards. Some of these have, you know, the in- 
dicia of, sort of, quasi-privacy communities, so to speak. 

So my real question for you is to help us understand what you 
are doing to assure that individual communication is not leading 
to individuals being identified by the Government and what you 
are doing to assure that we are not creating a chilling effect so that 
somebody in a community who is concerned about a particular 
issue will be more reluctant to write a letter to the editor, to post 
something on a blog. 

I will close my opening comments — and I know you have come 
prepared to answer these, but we are all very concerned about a 
couple of the circumstances that have happened. Most specifically, 
what looks as if it is a directive within the contract you have with 
a private contractor who is employed to help you disseminate or 
gather information. It is identifying media reports that reflect ad- 
versely on the U.S. Government, DHS, or prevent, protect, respond, 
or recovery activities. So, in effect, we are asking somebody to go 
out and let us know what people are saying that is negative about 
us. This appears to be what was asked for in the contract with 
General Dynamics. 

So I would like you to tell me what it is that we are doing to 
assure that private commentary is not being misused and what we 
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can do to assure that the activities of monitoring are not going to 
create some kind of a chilling effect on individuals’ willingness and 
readiness, not only to comment, but, frankly, to make comments 
which may be critical of the Government. 

Ms. Callahan. 

Ms. Callahan. Thank you, sir. 

With regard to the privacy protections that the Department has 
implemented specifically with regard to situational awareness, to 
be very clear, as Mr. Chavez said, it is the “what,” not the “who,” 
that is being identified and that we are concerned with. 

As you are aware, my office not only mandated privacy compli- 
ance reviews every 6 months to make sure that indeed we are just 
focusing on the event, on the situation, to know what is going on, 
and not worried about the individual; in addition to that, the Na- 
tional Operations Center has very robust auditing capability, that 
they go and review both the sites that are being done, how long 
they are on it, and what information is being implemented into the 
report. 

We take these issues very seriously, sir. We absolutely under- 
stand and agree that these are 

Mr. Meehan. Who is directing what is being monitored? 

Ms. Callahan. Mr. Chavez. 

Mr. Chavez. The key words, I guess, or the mechanism that we 
use to identify information that is coming across the media, wheth- 
er it be social or the traditional media that is out there, again, 
these are key words associated with events that have happened in 
the past and also with the equities of the Department of Homeland 
Security, again, looking at the safety, security, and resilience mis- 
sions that are out there. 

So, as you said in your opening statement, I believe, that there 
are any number of blogs going on at any one time and a plethora 
of information that is flowing through there, there is no way we 
could look at all of it. So we use the tools, again, with these key- 
word searches that are commercially available for looking at search 
items, particularly, again, keywords, that we can pull out of there 
and look at, again, what the situation is that is evolving. 

Mr. Meehan. But you are looking at keywords, but my question 
is, are there circumstances under which — who is the one that is 
waking up in this vast array of information out there? Because the 
limited number of people that you have working for you, unques- 
tionably, without some sense of direction, they could be spending 
limitless time, in effect, floating on a sea without any kind of prod- 
uct that is produced. 

So there has to be some sense of direction. Where does the line 
get drawn with regard to overlooking, sort of, general words out 
there versus looking at specific incidents, specific issues, and iden- 
tifying people, as happened in Michigan? 

Mr. Chavez. There are guidelines for sites that the individuals 
within the Media Monitoring Center can monitor. Again, those 
sites are submitted for approval through the Privacy Office, and 
they are strictly adhered to by the individuals who are actually 
looking at the information that is coming across there and gath- 
ering them for us. 

So there is a series of checks and balances. 
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Ms. Callahan. If I can, sir, in order to be transparent about 
this, in the Privacy Impact Assessment we have a list of the rep- 
resentative keywords. The Privacy Office reviews that list every 6 
months and makes sure that we stay within it. The list is “dis- 
aster,” it is, you know, “flood,” “tornado,” and things like that. 

With regard to individuals, as I indicated in my oral testimony, 
we don’t collect information on individuals. We do not monitor 
them with regard to any First Amendment activity. But individuals 
may be the first person at the scene, and so they may go and report 
there has been a train derailment in Michigan. We do not then go 
and say that, “Mary Ellen Callahan reported a train derailment.” 
We then corroborate it with another source that is identified 

Mr. Meehan. My time has expired, so I am hoping some others 
will pick this up. 

We know about the disasters. I don’t think we are worried about 
the disasters. What we are worried about are the individual cir- 
cumstances where there may be issues out there. I point back 
again to the Michigan circumstance where there was a controver- 
sial decision by the Government, and DHS played a role in assess- 
ing community response to that incident. That wasn’t a natural 
disaster; that was an incident that was created by the Government, 
and the Government then was monitoring the community response. 

That is where I want to — who is going to make the decisions? 
Who is making the protections against circumstances under which 
the Government is playing a role in not just analyzing but filtering 
back, recording, and reporting about things that people in the com- 
munity have said about Governmental activity? 

Ms. Callahan. I would be happy to answer the Standish ques- 
tion whenever the Members have given me the time to do so. 

Mr. Meehan. Thank you so much. 

I will turn it over to the Ranking Member, Ms. Speier. 

Ms. Speier. Thank you, Mr. Chairman. 

I am deeply troubled by the document that has just been put into 
the record by EPIC.org. While you have probably not had the op- 
portunity yet to review it, Mr. Chairman, I would like to request 
that after they do review it, that they report back to this committee 
and provide us with answers to the questions raised. But I am 
going to start with a couple of them. 

They made a FOIA request back in April. DHS ignored it. Then 
EPIC filed a lawsuit on December 23, 2011, when the agency failed 
to comply with the FOIA deadlines. As a result of filing the law- 
suit, DHS disclosed to EPIC 285 pages of documents. 

So I am just making note of that. You shouldn’t stonewall. When 
a FOIA request is made, you should comply with it within the 
deadlines. No entity should be required then to file a lawsuit. So 
I am just putting you on notice about that. 

But what is interesting about what they have pointed out is that, 
while you say there is no personally identifiable information in this 
contract that General Dynamics has, in fact they point out that 
there are some exceptions to the no-PII rule. One of them allows 
for the collection of personally identifiable information of anchors, 
newscasters, or on-scene reporters who use traditional and/or social 
media. This would allow the agency to build files on bloggers and 
internet activists, in violation of the Privacy Act. 
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I find that outrageous. I would like to ask you to amend the con- 
tract with General Dynamics to exempt that kind of information 
from being collected. 

Ms. Callahan. First, ma’am, with regard to the FOIA response, 
I completely agree. It did not meet my standards in terms of the 
timeliness of the response, and I have taken action to look into why 
it was delayed. That was unacceptable, and I completely concur 
with your statement. 

With regard to the reporters, to clarify, the reporter’s information 
is collected — and, as noted in my written testimony, the only infor- 
mation we collect on the reporters, if at all, is the name, their af- 
filiation, their title, if any, and their publicly available identifica- 
tion. We are only collecting the information if it adds to the credi- 
bility of the report or allows coordination. 

So it is very rare that we actually collect any information about 
the reporters. But it could be a circumstance where you link to a 
reporter’s blog who is at a news site. For example, in Michigan and 
the train derailment, if the person posted it on his personal blog, 
we may be authorized to link to it. We would not be authorized to 
collect it or use it for a personal — an individual, but only if the re- 
porter is relevant and adds credibility to the report itself. 

Furthermore 

Ms. Speier. I am 

Ms. Callahan [continuing]. To clarify, ma’am, just to clarify, the 
reporter information is only stored in that report. We are not cut- 
ting across the different reports. We are not saying how many dif- 
ferent reporters do it. It is information that is publicly available, 
and it is not associated with their opinions but instead with the sit- 
uation or the event that is occurring. 

Ms. Speier. I am suggesting to you that it is irrelevant, you do 
not need it, and you should suspend that part of the contract. 

Now, this document also suggests that you are capturing public 
reaction to major Government proposals. Now, again, if this is, in 
fact, true, if this is part of the contract, I believe that should be 
suspended as well. This is not a political operation; it should not 
be a political operation. Capturing public reaction to major Govern- 
ment proposals is not something you should be doing. 

Ms. Callahan. I completely agree with you, ma’am. I 100 per- 
cent agree with you, which is why the report that they point to on 
page 118 in the FOIA report actually was never a live report. It 
was never disseminated by the National Operations Center. It 
would not have met the privacy standards that are in the five pub- 
licly available Privacy Impact Assessments we have done. Further- 
more, it is an example of an early August 2009 example of what 
could be possible. We, together with the National Operations Cen- 
ter, agreed that that is well outside the scope. 

In fact, if you look at the document, it is within a very early, 
February 2010, training manual as an identification of a weekly re- 
port, because it is a compilation of other elements. If you look at 
the previous pages, you can see that they identify, like, “This is not 
acceptable,” “This is not appropriate,” “Redact the personally iden- 
tifiable information.” 

That Standish, Michigan, report is one that only appears — actu- 
ally, the only place it exists in the Department is in my files be- 
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cause of the privacy compliance review we did before launching the 
initiative. It is 

Ms. Speier. All right. My time is about to expire, so let me sug- 
gest the following. EPIC makes three recommendations at the end 
of their report. They recommend you cease collecting information 
on journalists’ activities, that you suspend the social network and 
media organization monitoring program until safeguards are put in 
place, and that you comply with providing Congress with an an- 
nual report that sets out in detail the legal standards for this activ- 
ity. I, for one, wholeheartedly agree with their recommendations. 

Mr. Chairman, I actually think we should have EPIC and others 
in the privacy community come and testify. I am deeply troubled 
by what we have heard so far this morning. 

The fact that you agree with me but yet much of this conduct 
continues is deeply troubling. 

I yield back. 

Mr. Meehan. Thank you, Ranking Member Speier. 

At this point in time, I would like to turn it over to the gen- 
tleman from Mississippi, the Ranking Member of the committee, 
Mr. Thompson, for questions he may have. 

Mr. Thompson. Thank you very much, Mr. Chairman. 

Ms. Callahan, will you provide the committee with a copy of the 
FOIA information that you provided to EPIC? 

Ms. Callahan. Of course. Absolutely, sir. 

Mr. Thompson. Thank you. 

Also, will you provide us with your analysis of why the FOIA re- 
quest went unresponded to and what did you do in that situation 
but also what will you do going forward so that other requests 
won’t be treated so cavalierly? 

Ms. Callahan. Absolutely, sir. 

Mr. Thompson. Mr. Chavez, do we create log-ons to monitor indi- 
viduals in this process? 

Mr. Chavez. Actually, we do not monitor individuals at all. What 
we are looking for, again, as I talked about, the keywords. Within 
the keywords you won’t find anyone’s name. Like, say, they are all 
verbs, those types of things that we are looking for. So, no, we don’t 
create log-ins for individuals to do that, and we are not looking or 
monitoring individuals. 

Mr. Thompson. Are there any times that you take down names 
of individuals? 

Mr. Chavez. Again, given the seven criteria that we have for life- 
saving, those type of circumstances, are the only time that we 
would collect the names, use the PII. 

Mr. Thompson. Who makes that determination? 

Mr. Chavez. That is part of our training course that we do for 
the individuals who are doing the media monitoring. We look at 
those processes. Again, they are audited twice a year. The most re- 
cent one was just done in November. 

Mr. Thompson. Who is “we” doing the training? 

Mr. Chavez. Actually, the National Operations Center, in coordi- 
nation with the Privacy Office. 

Mr. Thompson. All right. How does this interface with the Gen- 
eral Dynamics contract? 
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Mr. Chavez. Those are the individuals who are doing the media 
monitoring for us. 

Mr. Thompson. So let me get this straight. DHS is training a 
private contractor to do the media monitoring? 

Mr. Chavez. Part of it, yes, on their privacy rules and those 
types of things, indeed, we are. 

Mr. Thompson. Why are we training private contractors? 

Mr. Chavez. Well, to collect — their skill set, to collect the infor- 
mation we are. But what they don’t come with is, again, the DHS 
guidance that we have to give them. 

Mr. Thompson. I thought private contractors generally had an 
expertise that we didn’t have internally as an agency, and we 
would go outside to pick that capacity up. But now what you just 
said is for some reason we are training the outside people to do the 
internal work. 

Mr. Chavez. It is not overall training. Again, they do have those 
skill sets that they use. What we add from the Department, again, 
are those checks that we use to ensure, again, that the privacy 
guidelines are complied with. That is the part of the training that 
we do, and that is it. 

Mr. Thompson. Well, explain to me what skill sets General Dy- 
namics, with an $11 million contract, would have outside of DHS’s 
capabilities. 

Mr. Chavez. Well, what they offer, again, is the 24/7 monitoring 
of those sites. They are skilled technicians in surfing the web and 
also doing an analysis of the information that they get when they 
do get hits on websites and producing synopsized reports that, 
again, comply with the privacy guidelines that are out there, and 
pushing those out to us so we can send those out to our partners. 

Mr. Thompson. So your testimony is we don’t have the skill sets 
at DHS to monitor websites? 

Mr. Chavez. We do. Right now, again, we have that as part of 
one of our contracts that is out there. 

Mr. Thompson. Is it a sole source contract? 

Mr. Chavez. No, it is not. 

Mr. Thompson. Well, will you provide the committee with the 
procurement document? How long has it been out there? 

Mr. Chavez. I will get back with you on that. I will give you the 
full details on it. 

Mr. Thompson. Was the original contract for the $11 million a 
sole source contract? 

Mr. Chavez. I do not know. I will have to check on that for you, 
sir. 

Mr. Thompson. How long have you been working with the agen- 
cy? 

Mr. Chavez. Two years. 

Mr. Thompson. How long has this General Dynamics contract? 

Mr. Chavez. In the 2 years I have been there. 

Mr. Thompson. So you inherited the General Dynamics contract? 

Mr. Chavez. Yes, sir. 

Mr. Thompson. All right. Well, please get it to me. 

The questions raised by the EPIC insertion, as well as what ev- 
eryone has commented, raise significant issues around safeguards. 
Mr. Chairman, I think you would help a lot of people if at some 
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point we could, as Ranking Member Speier suggested, maybe bring 
those individuals and others who might have an interest before the 
committee to talk about it. 

I yield back. 

Mr. Meehan. Thank you, Mr. Ranking Member. We appreciate 
your presence here today on the subcommittee. 

The Chairman now recognizes the gentleman from Minnesota, 
Mr. Cravaack. 

Mr. Cravaack. Thank you, Mr. Chairman. 

Thank you for coming here today and briefing us. 

I think what everybody is really concerned about here is our 
Constitutional rights. Because we in the United States, we have 
this great document called the Constitution, and we have to walk 
this fine line of data attainment to protect the United States but 
to, at the same time, make sure that we have safeguards in place 
that we have freedom of speech, which we value highly. 

So, with that said, what safeguards are in place that when the 
DHS does collect and distribute personally identifiable information, 
PIIs, outside a specific narrow event such as a life-or-death situa- 
tion, can you kind of expand upon that a little bit? 

Then with that said, what would be the penalty associated with 
distributing that information illegally? Have there been any cases 
where that has occurred? 

Is there a report currently going from General Dynamics to you, 
to Congress that would also, when these people are identified, that 
Congress is aware of that? 

So, with that, Ms. Callahan, could you start off? 

Ms. Callahan. Absolutely, sir. Thank you very much for that 
question. 

As I have described and Mr. Chavez has described, the only per- 
sonally identifiable information that can be collected are these 
seven very narrow categories: Public officials or in a public event 
or making a public statement or life-or-death, as you pointed out. 

As part of the review by the National Operations Center, every 
week they go and check to make sure no personally identifiable in- 
formation is provided. I review each of the media monitoring that 
I receive as part of the ordinary course of business, just to see if 
they continue to comply with the privacy protections that we de- 
scribe in our five publicly available Privacy Impact Assessments 
and privacy compliance reviews. We then do these semi-annual re- 
views of the entire system to look at all the processes therein. 

Prior to me authorizing any personally identifiable information, 
there were, to my recollection, two circumstances where public offi- 
cials were named in the circumstance — for example, President 
Obama. There was no circumstance with regard to individuals who 
are not in a public capacity who have been named. 

Actually, that example of having a public official like the Presi- 
dent is why we agreed to have those seven very narrow categories 
that could be disclosed. Again, identifying Gabrielle Giffords as the 
target of the attack in Arizona actually helped coordinate the re- 
sponse more quickly, because we had that authorization. 

With regard to the penalty, if, indeed, that had taken place, 
there would be significant penalties. There would be training and 
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possibly taking them off the job if, indeed, there was a recidivist 
behavior. We have not yet seen that. 

With regard to a report from General Dynamics, I don’t know of 
that, but I do know that we have been doing these semi-annual pri- 
vacy compliance reviews, which are available on our website, for 
exactly the reason that everyone has identified: To make sure that 
we are following the privacy protections that we have identified 
and that we are not monitoring, reviewing, or collecting First 
Amendment-protected speech. 

Mr. Cravaack. Mr. Chavez, do you have any comment on that, 
as well? 

Mr. Chavez. No, that is exactly it. Again, we follow the guide- 
lines that the Privacy Office sets forth. We do audit on a regular 
basis the individuals who are doing those types of things. We have 
a series of individuals that are reviewing the data, again, to make 
sure that the PII is not inappropriately passed on, displayed, or 
stored. 

Mr. Cravaack. Okay. 

I would like to dovetail on what the Ranking Member said. Why 
did you pick General Dynamics, for example, to be the contractor 
for monitoring social sites and not keep it in-house, so to speak? 

Mr. Chavez. Sir, again, that was before my time. That is the con- 
tract I inherited. But I can get you the information on that. 

Mr. Cravaack. Okay. Who in DHS issued the directive for this 
establishment of this committee? You know, I agree, you have to 
get resource information and intelligence anywhere you can pos- 
sibly get them, for various reasons. But who initiated the directive 
to initiate this social networking? 

Mr. Chavez. DHS did, again, before my time, right after Hurri- 
cane Katrina. Again, with the advantages of looking at the media 
to get a more timely response, see what is going on, provide greater 
situational awareness, the decision was made to monitor the so- 
cial — or the media monitoring, traditional media. Then later on it 
evolved into the social media. 

Mr. Cravaack. Okay. One of the things that did kind of raise a 
red flag for me is reports on DHS components and other Federal 
agencies, positive or negative reactions to certain Federal organiza- 
tions. Who gave that directive? 

Ms. Callahan. As I understand, sir, that is part of the General 
Dynamics contract. As was said, it predates Mr. Chavez. 

The purpose of that is not to keep track of what they are nega- 
tively saying, but for operational purposes to understand whether 
or not the Department is candidly meeting its standards. If, indeed, 
there is a long line as TSA, we don’t care who is in the long line, 
but if someone tweets and says there is a long line, we then convey 
that information to TSA. It is part of the operational awareness 
that the National Operations Center does. 

Mr. Cravaack. Okay. My time has expired. I do have an issue 
with that, but I will yield back at this time. So thank you. 

Mr. Meehan. Thank you. Thank you, Mr. Cravaack. 

So, at this moment, the Chair will recognize the gentleman 
from — it is “Missoura” where you are from, right, not “Missouri”? 

Mr. Long. Right. You bet. 

Mr. Meehan. Mr. Long. 
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Mr. Long. Thank you, Mr. Chairman. 

Mr. Chavez, what can the agency point to as your legal basis for 
your social network and media monitoring program, which a lot of 
us I think today have expressed concerns threaten important free 
speech and expression rights? What legal basis can you point us to 
that either this activity could even be concerned with 

Mr. Chavez. It was, again, Section 515 of the Homeland Security 
Act, as amended, to provide situational awareness and, again, that 
common operating picture. 

Mr. Long. That is the legal basis for it? 

Mr. Chavez. Yes, sir, that is the legal basis. 

Mr. Long. Okay. 

Ms. Callahan, I, as a lot of us today, are very concerned about 
the chilling effect on our core First Amendment rights to political 
speech and free speech in general. Are there — what can you point 
us to? Are there protections to ensure that only necessary personal 
data is used and retained no longer than necessary to protect 
against accidental or deliberate misuse? 

Ms. Callahan. I, too, sir, am very concerned about the First 
Amendment and want to make sure that that is wholly protected 
with regard to this activity. We spent 9 months designing this pro- 
gram and have detailed it in the public Privacy Impact Assess- 
ments and compliance reviews. 

The standard by which we operate is, again, not the “who” but 
the “what is taking place.” What is the event that is going on? If 
an individual alerts us to that event, then that is the first report, 
but not the exclusive report. 

The way, sir, that we have the privacy protections embedded into 
the program is to make sure that no personally identifiable infor- 
mation is collected or disseminated unless it meets those seven cat- 
egories. 

Mr. Long. No what information? 

Ms. Callahan. Personally identifiable information. 

Mr. Long. Okay. 

Ms. Callahan. No personally identifiable information is collected 
except for those public figures or in a life-or-death circumstance. 
The National Operations Center goes and very robustly audits 
that, and then we go in every 6 months to make sure that, indeed, 
the representations are correct. 

The personally identifiable information, the very narrow topics — 
which, again, are public figures making public statements or part 
of an event, or a life-or-death circumstance — are stored only in the 
report. We are not doing a table or an analysis of each of the dif- 
ferent reports. They are only stored in that. 

In fact, I published a System of Records Notice, which is required 
under the Privacy Act. It was not necessary for me to do this; the 
general System of Records Notice for operations would have cov- 
ered this activity. But for transparency purposes, when I finally au- 
thorized the use of personally identifiable information, we pub- 
lished that System of Records Notice to go and say, these are the 
seven categories that we are doing — public figures at public events, 
or life-or-death circumstances — in order to be very clear about what 
we are doing with information and, candidly, sir, what we are not 
doing with information. 
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Mr. Long. So, in your mind, you are convinced that what you are 
doing is consistent with existing DHS policy? 

Ms. Callahan. Consistent with DHS policy, consistent with the 
Privacy Act, and consistent with the First Amendment, yes, sir. 

Mr. Long. Okay. 

I have another question for you, Ms. Callahan. As the public be- 
comes aware of Government activity monitoring social media to 
gain rapid understanding of events, what are the risks of people or 
groups trying to affect those events, I guess — say, people with bad 
intentions using the different platforms of social media to manipu- 
late the Government understanding to their advantage? What can 
be done to guard against this problem? 

Ms. Callahan. My colleague Mr. Chavez may also have some 
thoughts about that. But I think that, because we don’t rely on just 
one individual source but we actually confirm the sources and look 
for making sure that we have multiple sources identifying, for ex- 
ample, the train wreck in Michigan, would be one element. 

Also, to confirm, the National Operations Center, the situational 
awareness, is not attempting to investigate or confirm the validity 
of the event, just that an event has been reported. 

Mr. Chavez. 

Mr. Chavez. Ms. Callahan is absolutely right. No single source 
of information ever provides us with a complete picture. Oftentimes 
we use multiple sources — or, all the time we use multiple sources 
of information to corroborate information that we are getting in. 

So it is all part of the big picture. In order to get the big picture, 
again, in this environment, we look to multiple sources that are out 
there, not a single source, to corroborate that information that is 
being produced. 

Mr. Long. How does that affect people trying to I guess put a 
different spin or take advantage of 

Mr. Chavez. There is always that — yes, there is always that de- 
ception. 

Mr. Long. That was kind of my question. 

Mr. Chavez. If it doesn’t match up with the preponderance of in- 
formation coming in that is counter to the information we are re- 
ceiving, then we can pretty much write off that. Plus we are not 
investigating that information, we are turning that over to the ap- 
propriate law enforcement or Government agency to look at what 
is happening again and is it really happening. 

Mr. Long. Okay. I have no time to yield back, but if I did, I 
would. 

Mr. Meehan. Well, thank you, Mr. Long. Thank you for your 
questions. I am going to exercise the prerogative to ask a couple 
of follow-up questions and certainly would make that opportunity 
available to anybody who would like to as well or not. 

Ms. Callahan, you spent some time talking about the cir- 
cumstances in Michigan and about some protections. I know you 
haven’t stated it today I spent time going through your written tes- 
timony and other sorts of things. I know you suggested that this 
is an anomalous circumstance. This is being identified as an event 
that happened, but maybe the statement would be but it wouldn’t 
happen today. You have a moment, tell me how you have cured 
that kind of a circumstance and how we would not have a repeat 
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where there is an incident that occurs in which the Government be- 
gins to be looking for the information that was disseminated, col- 
lected, and disseminated in Michigan. 

Ms. Callahan. Yes, thank you, sir. To clarify slightly, that infor- 
mation was never disseminated, it was never a live report, it does 
not meet the standards of the privacy impact assessments and 
would not have actually been done. It was an early example of 
what could possibly be done. Together with the National Oper- 
ations Center, we both agreed that we don’t care about First 
Amendment speech, we don’t care about the events. 

Mr. Meehan. Well, you do care. What you are trying to say is 
that is not what you are inquiring about? 

Ms. Callahan. We care about the events, not the First Amend- 
ment elements. Right, we care about the events. Candidly even in 
that example, Guantanamo Bay and the transition of any prisoners 
from Guantanamo Bay is actually not within the Homeland Secu- 
rity mission. So it wouldn’t even have met that threshold question. 
That is the current threshold standard that we implemented since 
January 2010, making sure it is a Homeland Security mission and 
an event and a situation. So for those two that is kind of a thresh- 
old point. We then would not — as I said, no element of First 
Amendment protected speech is collected, disseminated, or ana- 
lyzed. 

We also make sure that — as I said, I review the media monitor 
reports when I receive them to make sure that they continue to be 
compliant, that we are only reporting on the what and not the who. 
So I think all of these multiple levels are an example of why that 
Standish, Michigan, to give an example, is an anomaly. It is obso- 
lete, and it only is in the handbook that was done, that is 2 years 
old, and was quickly replaced once we started to work on the pilots 
and to fine-tune to make sure that we can provide situational 
awareness and protect privacy. 

Mr. Meehan. Let me go back then to prospectively where we 
may be looking at other kinds of events, as you say the who, not 
the what. Now I know there were attempts to look at things like 
the Olympics, there was an effort to track information that may be 
related to that. I can foresee a number of other events, conventions, 
are you going to be monitoring activity around conventions? 

Ms. Callahan. Again, I turn it over to Mr. Chavez, but we do 
monitor National security special events to make sure. For exam- 
ple, we monitored the Super Bowl. But again it is not about the 
who, but the what. How are the roads moving, how are the proc- 
esses, are there any suspicious activities? 

Mr. Meehan. You are not calling in the plays for Bill Belichick, 
are you? 

Ms. Callahan. I abstain on which — who I was supporting in the 
Super Bowl, but it is the what, it is the event. 

Mr. Chavez. Holistically we are monitoring the whole Homeland 
Security enterprise, not just the events. We are looking for the 
same, again, keywords criteria that would indicate any type of ac- 
tion — 

Mr. Meehan. You keep saying keywords. What I am trying to get 
to is who begins the process of identifying what should be analyzed. 
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I guess the what, not the who, but who is it that is saying to go 
after the what. I don’t know where this has begun. 

Mr. Chavez. Right. It is not the National Operations Center. 
Again the National Operations Center is the messenger. 

Mr. Meehan. Who is giving the direction? I want your analysts 
to look into X. Where does that come from? 

Mr. Chavez. That again does not come from the National Oper- 
ations Center. 

Mr. Meehan. I know it doesn’t. 

Ms. Callahan. So if I can just step back for a second, sir. The 
National Operations Center is to provide situational awareness for 
the entire Homeland Security enterprise. The way that we imple- 
mented the Social Media Initiative was to provide these keywords 
that you can use on publicly commercially available software that 
you can basically refine, no see individual Tweets, but see what is 
trending and what is happening and if there are elements. The 
keywords, as I said, are disclosed in my privacy impact assessment. 

Mr. Meehan. But when your analysts start work in the morning, 
do they just pick up a keyword book and start going out looking 
for 

Ms. Callahan. No, it is programmed in all the time, is what I 
was going to say. It is programmed in all the time. We don’t modify 
the keywords, disaster, flood, tornado, train wreck, derailment, 
those sorts of things. 

Mr. Meehan. You keep talking to me about incidents that are 
disasters, and I get that. We are going to put that aside. Part of 
the mission here was to monitor activities that may be — we are 
Homeland Security, we are worried about the potential that there 
could be someone acting in some capacity that would threaten our 
homeland and cause harm to the American citizens. I get that, too. 
We are also worried about the fine line in which people may be 
talking about things they don’t like about their Government, it is 
legitimate protest. So where are there activities that are taking 
place that it could be a collaboration of individuals from outside the 
country that are meeting at a convention all over the world. Does 
somebody say, hey, let’s watch what is happening there. I need to 
know where this process begins, who’s telling people to track the 
what? 

Mr. Chavez. The individual Government agencies we provide, we 
will call them our customers, are the ones who determine whether 
or not the data is actionable or not, whether or not to pursue a fol- 
low-up, each of those executing their own authorities to do the in- 
vestigations to collect intelligence in those type things. Often again 
the reports we provide through the social media monitoring are a 
supplement to getting the information to these organizations. 

Mr. Meehan. So it might be a legitimate investigative agency 
that has the capacity to in their own right but using legitimate in- 
vestigative tools and protections, they are asking you to get sec- 
ondary publicly available information that fills a gap or something 
of some sort? 

Mr. Chavez. Most definitely. Again once the reports come in we 
very seldom get the direction from an outside organization to look 
for specific things because under their own authorities they can 
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drill down farther than the National Operations Center can on in- 
formation that was provided. 

Mr. Meehan. Where does the top of the line come from; is this 
a career professional that makes these decisions or public ap- 
pointee in the DHS who may be overseeing what is being looked 
at? 

Mr. Chavez. Let me take an example of the intelligence field 
with their skill sets they have in the enterprise. There are individ- 
uals, both political appointees and senior officials, that again take 
a look at the information they have and decide whether or not to 
take action on to pursue investigations to open up whatever, again 
under their authorities, they can do to defend the homeland and 
produce that information in these reports. 

Ms. Callahan. If I could summarize, sir. The Situational Aware- 
ness Initiative we have been talking about is essentially breaking 
news, here is what is happening. To your point, if indeed someone 
receiving a report of breaking news and they have the underlying 
authority to investigate it, then they go off on their own track and 
the operations nor does the Privacy Office know they are doing it 
separate and apart from we are going to do audits and reviews of 
social media when the management directive is final. So they are 
breaking news and then other there are other authorities in the 
Department and also throughout the Federal Government. 

Mr. Meehan. Final question. Breaking news, the Attorney Gen- 
eral just decides he is going to try Guantanamo detainee in New 
York City. There is a lot of news about that now. Is it possible that 
you would be contacted by somebody who said follow what is hap- 
pening, report to us what the reaction is to that? 

Mr. Chavez. In the history of the time I have been at the Na- 
tional Operations Center, no, sir, that has not happened. 

Mr. Meehan. What would be your protection against that kind 
of request? How to you tell a political appointee who is high up in 
the administration that is not appropriate for us to monitor? 

Mr. Chavez. It is not only appropriate, it is not under our au- 
thority. It is illegal to do that. 

Mr. Meehan. Well, that is a good answer to any kind of a polit- 
ical appointee. At this point I have gone well over my time. 

Mr. Thompson. 

Mr. Thompson. Yes, I do. Ms. Callahan, you talked about taking 
9 months to put this program together. 

Ms. Callahan. Yes, sir. 

Mr. Thompson. Did you vet the program with any outside stake- 
holders or was it strictly an internal process? 

Ms. Callahan. Actually, sir, with regard to the situational 
awareness I discussed it in my quarterly meeting with advocates 
that takes place, I believe after the initiative launched but before 
it became a program, so during the three pilot phrases. 

In addition, one of my staff testified in front of my FACA com- 
mittee, the Data Privacy and Integrity Advisory Committee early 
in the process. In fact in December I had hoped to have one of Mr. 
Chavez’s colleagues testify in front of the Data Privacy and Integ- 
rity Advisory Committee, but unfortunately — he was there, he was 
prepared to testify about this very issue because of the importance 



31 


of the issue but we ran out of time. But yes, we have discussed this 
publicly and gotten advice on it. 

Mr. Thompson. Well, I am concerned that given what I am pick- 
ing up that there are a lot of people who have interest in privacy 
and this whole area that has not been included in the discussion. 
What I would like for to you do is provide us with those organiza- 
tions or individuals who you have collaborated with over that 9 
months to develop this program. 

Ms. Callahan. To be clear, sir, I did not discuss this outside the 
Department until it was launched as a pilot under the Haiti earth- 
quake, but then I did discuss it, as I said, in several advocate meet- 
ings, that I have quarterly advocate meetings with advocates and 
we did discuss it publicly in the FACA committee. But we are 
happy to provide you that information. Yes, sir. 

Mr. Thompson. Whoever the advocate, whoever attended, how 
broad that attendance is, all that, just please get it to us. 

Ms. Callahan. Absolutely. 

Mr. Thompson. The other concern I have is taken off of from 
what the Chairman was talking about, is the notion of identifying 
political and journalistic activities that reflect adversely on the 
agency or the Federal Government. Ms. Chavez, it is your testi- 
mony that you don’t do this? 

Mr. Chavez. Indeed, we don’t do that. What we do do again is 
if there are long lines at the airport, at the screening centers, those 
types of things, those would come up to us, and we would pass it 
on to the appropriate DHS component for action again through cor- 
roboration, is this really happening, what is happening and what 
we need to do to fix that. But identifying individuals again or an 
individual that is making that would be irrelevant to us. There is 
something happening, go check it out. 

Mr. Thompson. Well, okay. I will go back to the General Dynam- 
ics contract again. Obviously some of us are troubled by it. Why 
would you ask them to look at the Drudge Report or New York 
Times or L.A. Times ? 

Mr. Chavez. We don’t focus again on any one media source. 
There are many that are out there. It all goes back to the informa- 
tion that they are providing, not the provider of that information. 

Mr. Thompson. So they are the only source of — so in other 
words, they have this expertise that they can look at the blogs and 
read the newspapers better than the Department if that is what 
you want to do? 

Mr. Chavez. Well, you have to look at it also. We are not in here 
currently watching television or looking at the media reports that 
are coming in. We all have a vested interest in this Homeland Se- 
curity. So what we are providing is a service where we are looking 
at individual action or actions that could be happening around the 
United States and elsewhere that again we see and push that in- 
formation out to the Federal Government and our State and local 
partners, the entire homeland security enterprise, to let them know 
that something is happening. They may already see it and be act- 
ing on it, in which case we would receive information from those 
agencies on here is what is currently going on with this also. 
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Mr. Thompson. Ms. Callahan, to your knowledge are there any 
other branches of the Federal Government who are doing similar 
kind of programs? 

Ms. Callahan. I don’t have a comprehensive knowledge of this, 
but I do know that National Operations Center has a unique statu- 
tory responsibility to provide situational awareness to the Federal 
Government. So I am not aware that anyone else is doing that 
given the NOC’s authorities. 

Mr. Thompson. FBI, DOD, nobody to your knowledge? 

Ms. Callahan. I believe they are operating within their own au- 
thorities consistent with what I discussed with the Chairman. 

Mr. Thompson. I just asked you. 

Ms. Callahan. I don’t know, sir, sorry. 

Mr. Thompson. So you don’t know — you designed the program 
without any review of whether or not another agency is doing it? 

Ms. Callahan. As I said, sir, I believe the NOC’s statutory au- 
thority is unique. 

Mr. Thompson. No, no, no, just answer the question. 

Ms. Callahan. I do not have any other knowledge. 

Mr. Thompson. You said it took 9 months to put the program to- 
gether, and I just want to know as part of your due diligence did 
you check and see whether or not another agency within the Fed- 
eral Government was doing something just like this. I would as- 
sume that the FBI would be doing something like this, I would as- 
sume that DOD would be doing something like this, just given 
their mission. If you say you don’t know, I don’t think that is the 
right answer from a due diligence standpoint. 

Ms. Callahan. I can check with my staff, and maybe Mr. Chavez 
is aware of what other people are doing in this. We are trying to 
be very transparent about what we are doing and perhaps the 
other departments have not necessarily taken that tack. 

Mr. Chavez. I am not aware of anyone else that is doing the so- 
cial media monitoring at again the unclassified level. The intel- 
ligence community with their skill craft may, but no, I don’t. 

Mr. Thompson. I yield back, Mr. Chairman. 

Mr. Meehan. Thank you, Mr. Thompson. It appears to me as we 
have been going through this issue I have got the very difficult rec- 
ognition that as I chastise my children about spending significant 
time on Facebook, they are now going to be saying to me, well, dad, 
it can be a career. 

At this point let me turn it over to the gentleman from Min- 
nesota for a few follow-up questions. 

Mr. Cravaack. Thank you, Mr. Chairman. Does DHS use any 
other contractors to monitor to the best of your knowledge? 

Mr. Chavez. Right now, no, we don’t, sir. 

Mr. Cravaack. Is there any plans to? 

Mr. Chavez. Right now we have got all we need with, again, the 
services being provided. 

Mr. Cravaack. Just kind of dovetailing what the Ranking Mem- 
ber was saying, one of the things I read is that you want to capture 
public reaction to major Government proposals. You are monitoring 
positive or negative reports on FEMA, CIA, ICE. 

Mr. Thompson. Would the gentleman yield? 

Mr. Cravaack. Yes, sir, I will yield. 
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Mr. Thompson. I asked you a question about the General Dy- 
namics contract. You told me there was an RFP out right now. 
That was your answer to me on social monitoring. You look back 
to the gentleman, you said it wasn’t sole source, it was open. That 
was your answer to me then. 

Mr. Chavez. It is a firm fixed contract, not sole source. 

Mr. Thompson. But you said there is an RFP out right now. 

Mr. Chavez. RFP. I am sorry, I am not familiar. 

Mr. Thompson. Request for proposal. We talked about the Gen- 
eral Dynamics contract. We asked about it. Your conversation 
talked about whether or not it was sole sourced or it was open, and 
you indicated that we are going out looking for another contract 
right now. 

Mr. Chavez. No. If I did, sir, I apologize, sir. I stand corrected. 
It is a firm, again, fixed contract and again not sole sourced. 

Mr. Thompson. How long is this fixed for? 

Mr. Chavez. Actually, I don’t have that information. I don’t have 
the fixed. 

Mr. Thompson. Thank you. Thank you for yielding. 

Mr. Cravaack. Yes, sir. I will reclaim my time. Going back, it 
was mentioned some of the — you know, FEMA, CIA, CBP, ICE — 
these are organizations that are outside of DHS. Now if some- 
body — if there was an organization outside of DHS requesting this 
information, would you provide it to them? 

Mr. Chavez. We don’t normally get, again, requests for informa- 
tion. We just take it from the media and push it to the organiza- 
tions that are out there because they have their own information 
authorities, gathering authorities and those types of things that 
they use. So they use our media monitoring reports to supplement 
what they have already got. 

Mr. Cravaack. The thing I am really having problems with I 
guess is the Government proposals, reactions to Government pro- 
posals and then feeding that information to different organizations 
within the Government. You are using a public sector source that 
may be used for private individual attainment of information for 
other reasons then that would benefit the public. That is what I am 
concerned with and how would you go about preventing this from 
occurring? 

Mr. Chavez. That specific purpose of the media monitoring I 
have never encountered. Again, the only kind of evaluation, if you 
will, of the departments or other Government agencies is just, as 
I said, there is a service that is being provided, that again there 
is a hold-up at the airports, as Ms. Callahan said also, but to go 
out and solicit that information or to collect it. I have not seen this 
in my tenure at DHS. 

Mr. Cravaack. Well, now this hearing has occurred, I think you 
have a higher profile. But my question would be what are the 
checks and balances in there from ensuring that this is not used 
for private initiatives? 

Mr. Chavez. Again, with the information that comes in it is re- 
viewed by a number of individuals throughout the National Oper- 
ations Center and Operations Coordination and Planning to ensure 
that the compliance with the PIIs out there and the distribution 
lists also are pre-approved so that it doesn’t get out to sectors, 
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again so we don’t compromise proprietary information and those 
types of things. 

Mr. Cravaack. Can you give me an example of what kind of in- 
formation you have been gleaning thus far in regard to Govern- 
ment proposals? 

Mr. Chavez. I am not aware of any information we have gath- 
ered on Government proposals. 

Mr. Cravaack. Okay. All right. Say I am ICE or say I am those 
who would be interested in the gun walking down in Mexico and 
I want to get information in regards to what is the public reaction 
to this. Say I am an organization, I am just trying to use broad 
general terms so we don’t have to get into another area, a realm. 
How would you go about that request? 

Mr. Chavez. Again, that would not be a request that was appro- 
priate or a function of the National Operations Center. Given our, 
again, authority under the Homeland Security Act for a situational 
awareness or operating picture, we are not a pollster, we don’t 
again solicit for opinion. We are putting down actual incidents that 
are happening at any one time. 

Mr. Cravaack. Okay, I am the Attorney General, I am asking for 
this information. 

Mr. Chavez. Okay. 

Mr. Cravaack. What are you going to tell him? 

Mr. Chavez. Again, that is not the appropriate mission or within 
our authorities for the National Operations Center to gather that 
information. There are other organizations within in the Federal 
Government who do have the authority to gather that information 
more thoroughly, again, than we do. 

Mr. Cravaack. Mr. Chavez, you are telling the Attorney General 
that I cannot acquire this information, this is a vital need for 
American security. 

Mr. Chavez. It would be outside the skill set of what we actually 
do. We are not the source for that. So I would not be afraid to tell 
the Attorney General that we are not the organization that does 
that. 

Mr. Cravaack. You are an Air Force officer, aren’t you? 

Mr. Chavez. Yes, sir. 

Mr. Cravaack. Hooray. With that, I yield back. 

Mr. Meehan. Mr. Long, do you have follow-up questions? 

Mr. Long. Well, you know that, sure. Thank you, and to my 
friend from Minnesota Mr. Chavez may be better known after this 
hearing but I just checked Twitter and we are not yet a trending 
topic on there. 

The longer I sit here I think the more confused I get. The title 
of what we are supposed to be talking about today is “Department 
of Homeland Security Monitoring Social Networking and Media: 
Enhancing Intelligence Gathering and Ensuring Privacy.” We are 
all kind of in agreement on that? 

Ms. Callahan. Yes, sir. 

Mr. Chavez. Yes, sir. 

Mr. Long. Of course we had a classified briefing yesterday and 
I came away from that thinking what we were trying to do is pro- 
tect the homeland and watch for events that may affect the secu- 
rity of citizens here in this country. But yet today I keep hearing 
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about breaking news, which Twitter is pretty good for that. So ei- 
ther one of you can answer this if you want. I appreciate you being 
here today, but what is your charge? I have a disconnect with the 
breaking news, trying to follow that up. I mean that is history, 
breaking news has happened. Prevention and protecting the citi- 
zens while ensuring their Constitutional rights is a whole different 
can of worms. So both of you can answer this: What is your charge? 
What do you visualize your job and the agency job as far as — am 
I completely off-base that we are supposed to be trying to protect 
the homeland while ensuring privacy, as they say? 

Ms. Callahan. You are correct that that is our mission. That is 
the point of this hearing. I think the disconnect perhaps is that, as 
I pointed out in my oral testimony, there are three uses of social 
media. We have been focusing on the second, which is the situa- 
tional awareness, which is the breaking news element, to know 
there is an event that could impact the homeland. 

The third element, which is the operational use you spoke to the 
under secretary yesterday, about when we would do it consistent 
with our authorities for law enforcement or other investigatory pur- 
poses using social media if there was a predicate, some sort of rea- 
sonable suspicion or elements for that. That is kind of the third ele- 
ment on the prevention side. Mr. Chavez and I have been speaking 
a lot about the situational awareness, which is the second of the 
three uses that the Department uses social media for. 

Mr. Chavez. The National Operations Center again is part of the 
bigger picture out there. We are one of the tools that again the 
agencies use to again monitor the homeland and those types of 
things, again that they do under their own authority. So to put the 
intelligence piece in there with the Nation Operations Center, we 
are providing through the National Operations Center another 
piece of information that again those individuals who can use intel- 
ligence under their authorities or enhance their operations as with 
ICE, as was brought up in the other departments or components 
of DHS, that is what they do with it. We provides one piece of the 
information, the total information that is out there that they can 
use and that source again is the media portion of that. 

Also, because the intelligence and all those other communities 
that are out there looking at it, again may not see something hap- 
pening because they are executing a mission that is out there. 
What we do again is provide that service that something is hap- 
pening, turn it over to the appropriate Government agency, to in- 
clude State 

Mr. Long. That is all after the fact, correct? 

Mr. Chavez. Indeed. There are other organizations that again 
that are looking at the prevention piece and looking, doing assess- 
ments to determine what threats may be coming at us. We are 
dealing with the here and now. 

Mr. Long. I am sure there is something I am missing because 
I can’t believe that we would go to all this effort to look into break- 
ing news. 

Ms. Callahan, another question for you to wrap up. I am going 
to try this, can you describe the Department’s on-going privacy and 
civil liberty protection oversight process that is in place now to en- 
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sure citizens’ Constitutional rights are not violated during the exe- 
cution of the Department’s social media monitoring? 

Ms. Callahan. Yes, sir. Thank you very much for that question. 
The Congress has been very generous with my oversight authority, 
and as I have described earlier, we have been doing mandated, re- 
quired privacy compliance reviews that we publish on the website. 
To be clear about what is going on with regard, we are doing these 
reviews every 6 months, in fact February we started again. 

We are also authorized to do investigations into individual types 
of use of social media, as I said kind of that third category in an 
operational sense. We are finalizing a management directive to 
make sure that everyone complies with privacy protections across 
the board with regard to investigations and operational use. In 
there we are requiring audits every 3 months, as well as specific 
investigation by my office. So we take this issue very seriously and 
we try to be as diverse and robust in working with the Office of 
Civil Rights and Civil Liberties in all three categories in which the 
Department uses it — communication, situational awareness, and 
operational use. 

Mr. Long. During those 3-month and 6-month checkups are you 
finding things that are of concern to you about people’s Constitu- 
tional rights? 

Ms. Callahan. We have not. No, with regard to the situational 
awareness, the second use that the Department uses, the National 
Operations Center has been very consistent with the public-private 
protections that we have identified. 

Mr. Long. Thank you all for being here today and I yield back. 

Ms. Callahan. Thank you, sir. 

Mr. Meehan. Thank you, Mr. Long. I want to express my appre- 
ciation to the panel for being with us here today. I think we have 
begun an important discussion, and there is appreciation of the dif- 
ficult charge that you share with some of the other agencies here 
who not only protect our homeland but American interests around 
the world. I am grateful for your service in that capacity. 

I think all Americans appreciate the huge challenge of fulfilling 
the responsibility of having the imagination to appreciate what 
could happen and connecting the dots real-time, all of things we 
are asking you to do to prevent another issue of terrorism here on 
American soil, but we also appreciate that you are one of the real 
protectors of the individual’s rights to privacy, what it means to be 
an American, and this is a delicate and difficult area that I think 
we have to continue to explore. I am asking you to continue to use 
your diligence and most assuredly to assure that there isn’t inap- 
propriate interference politically, especially inappropriate political 
interference in which somebody takes your mission and uses it for 
another purpose, and that every effort be made to safeguard the 
rights, the privacy rights of individuals. 

We may have another opportunity to follow up on things we did 
not get into because, as I say, I appreciate what you are doing at 
the DHS level. I am cognizant in my own State of Pennsylvania of 
the historic context in which State-run but related fusion centers 
and otherwise have conducted these same kind of inquiries, and 
that information found its way not just to Governmental entities 
but to private contractors, private businesses who were using it for 
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their own purpose. So this whole question of, you know, who is col- 
lecting what information, what are we doing to safeguard it and 
what are we doing to assure that at some appropriate time it dis- 
appears. 

There is a lot here. I know it is part of your job. I thank you for 
the work that you are doing, but we are going to continue to ask 
these tough questions because it is vital to the protection of the 
most fundamental thing we have, which is our Constitutional 
rights as American citizens to privacy and to be free from inappro- 
priate Governmental intrusion. 

Thank for your work and thank you for your testimony. The 
Members of the committee may have additional questions for wit- 
nesses. If they do, we will ask you to respond in writing. I know 
there are some things that were asked that you go back and do 
your best to be responsive to the questions that the committee did 
ask. The hearing record will remain open for 10 days. 

So without objection the committee stands adjourned. 

[Whereupon, at 11:35 a.m., the subcommittee was adjourned.] 




APPENDIX 


Letter Submitted to Chairman Patrick Meehan From Mary Ellen Callahan 

and Richard Chavez 


March i, 2012. 

The Honorable Patrick Meehan, 

Chairman, U.S. House of Representatives, Committee on Homeland Security, Sub- 
committee on Counterterrorism and Intelligence, Washington, DC 20515. 

Dear Representative Meehan: Thank you for the opportunity to testify before 
you and your subcommittee on February 16, 2012 about Department of Homeland 
Security (DHS) review of publicly available social media websites. DHS remains 
fully committed to providing the subcommittee with all of the information it re- 
quires on this topic. We ask that our letter, along with the enclosed attachment, be 
incorporated into the official record for the February 16, 2012 hearing before your 
subcommittee. 

At the hearing, questions were raised regarding contract language that appeared 
to permit the use of social media websites to track First Amendment-protected 
speech by collecting information on public dissent or disagreement on Government 
activities. As detailed in our written testimony DHS does not now, and has never 
collected or used, social media reporting for such purposes. We will modify the exist- 
ing contract and all DHS documentation to clarify and align guidance language with 
the Privacy Impact Assessments (PIAs). 

To further illustrate this point, this week Director Chavez issued the enclosed 
memorandum to the National Operations Center (Attachment 1) stating that the Of- 
fice of Operations Coordination and Planning and the Privacy Office are currently 
reviewing the 2011 Media Monitoring Analyst’s Desktop Binder to ensure alignment 
with the PIAs. Although the media monitoring efforts are in accordance with the 
privacy guidelines outlined in the PIAs it is important that all documentation relat- 
ing to media monitoring be similarly aligned. The Privacy Office will complete its 
fourth Privacy Compliance Review in mid-March 2012 and this alignment will be 
part of the review. 

Director Chavez’s memorandum to the National Operations Center also reiterates 
the privacy guidelines that have been in place since the start of this program: Col- 
lection of personally identifiable information from social media websites is permitted 
only in specific circumstances and is limited to the categories described in our writ- 
ten testimony and in the January 6, 2011 PIA. The information that is collected 
may be retained only in the report that is generated, and is not cross-referenced or 
tracked in any other way. 

We appreciate the subcommittee’s interest in our efforts in this regard. We would 
be happy to meet with subcommittee staff or Members individually the week of 
March 5, 2012 to provide you with any further information or discussion of these 
issues you may require. NOC media monitoring reports are also available for your 
review. 

Sincerely, 


Mary Ellen Callahan, 

Chief Privacy Officer, U.S. Department of Homeland Security, 

Richard Chavez, 

Director, Office of Operations Coordination and Planning, U.S. Department of 

Homeland Security. 


( 39 ) 
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MEMORANDUM FOR: National Operations Center 

FROM: Richard Chavez, Director, Office of Operations Coordination and Planning 
SUBJECT: Media Monitoring Guidance Reminder 

As part of the fourth Privacy Compliance Review that is scheduled to occur in 
mid-March 2012, the National Operations Center (NOC), in coordination with the 
DHS Privacy Office, will review the 2011 Media Monitoring Analyst’s Desktop Bind- 
er, any associated standard operating procedures, and the existing media monitoring 
support services contract to ensure conformity with all Publicly Available Social 
Media Monitoring and Situational Awareness Initiative Privacy Impact Assessments 
(PIAs) and to ensure the scope and purpose of the NOC Media Monitoring Capa- 
bility (MMC) are accurately reflected and recommend clarifications and updates to 
the language if necessary. In the interim, the NOC will continue to use the PIAs 
as the authoritative source to guide the program. 

The NOC MMC should continue to limit the review, use, collection, and dissemi- 
nation of non-personally identifiable information and the seven narrow categories of 
personally identifiable information to information that affect the operations of the 
Department of Homeland Security (memorialized in the January 2011 PIA). No 
First Amendment-protected speech relating to dissent or disagreement with the De- 
partment and its activities should be reviewed, used, collected, or disseminated. 

The MMC can review, use, collect, and disseminate information intended to pro- 
vide guidance on DHS programs and initiatives that inform the general public. An 
example would be the Transportation Security Administration’s PreCheck program. 
The MMC can also review, use, and collect information related to oversight reports 
about DHS components such as DHS Inspector General Reports or Government Ac- 
countability Office Reports. 

The MMC cannot review, use, collect, or disseminate information related to indi- 
viduals’ positive or negative opinions or reports on the Department, but for the nar- 
row circumstance where the MMC reviews and informs the relevant Component of 
an operational issue adversely impacting the Component. Examples of these issues 
include security violations at airports or ports of entry. In this narrow operational 
circumstance, no personally identifiable information can be collected, stored, or dis- 
seminated to the relevant Component. 


Questions Submitted by Ranking Member Bennie G. Thompson for Mary 
Ellen Callahan and Richard Chavez 

Question 1. Please explain the circumstances under which DHS might collect in- 
formation on journalists. 

Answer. DHS does not collect information on journalists (other than recording the 
name of the author when saving a particular article so as to ensure proper attribu- 
tion, or including a individual journalist’s name that is part of that journalist’s so- 
cial media internet link). As described below, DHS collects information on events. 

In support of its statutory mission to provide situational awareness and a common 
operating picture for the Federal Government and for other homeland security en- 
terprise partners, the National Operations Center (NOC) within the DHS Office of 
Operations Coordination and Planning reviews publicly available traditional and so- 
cial media postings to gain an enhanced awareness of rapidly emerging or evolving 
incidents and events concerning homeland security, emergency management, and 
National health. If a journalist posts a report on a publicly available social media 
site about a breaking news incident relevant to homeland security, the NOC’s media 
monitoring analysts may use the information posted to build a report that is distrib- 
uted to DHS leadership and other homeland security partners including Federal 
interagency, State, local, Tribal, and territorial government entities. The NOC may 
include reporters’ names and affiliations in the reports as described below. 

The NOC includes a particular journalist’s name with recorded media in accord- 
ance with the guidelines set forth in the Publicly Available Social Media Monitoring 
and Situational Awareness Initiative Privacy Impact Assessment (PIA) (dated June 
22, 2010) and its January 6, 2011 update. As stated in the PIA update and the Feb- 
ruary 1, 2011 System of Records Notice, personally identifiable information on seven 
narrow categories of individuals may be collected when it lends credibility to the re- 
port or facilitates coordination with Federal, State, local, Tribal, territorial, foreign, 
or international government partners. In such instances DHS will only collect the 
following limited pieces of information from journalists: Names, titles, and organiza- 
tional affiliation of anchors, newscasters, or on-scene reporters who are known or 
identified as reporters in their post or article or who use traditional and/or social 
media in real time to keep their audience situationally aware and informed. Fre- 



41 


quently with breaking news on social media, the individual journalist’s name or 
names of other key individuals will be part of the story’s internet link. In order to 
disseminate these publically available links, the NOC must include the personally 
identifiable information contained in the link address. Removing the PII from the 
link address will render the link, and thus the story, unusable. 

All National Operations Center (NOC) social media initiative PIAs are available 
to the public at www.dhs.gov/privacy. 

Question 2. Please explain how DHS came to report on information related to citi- 
zens’ opinions on moving Guantanamo Bay Detainees to Standish, MI, and whether 
this is an appropriate use of social media by DHS. 

Answer. The DHS Office of Operations Coordination and Planning (OPS) never 
reported on potential plans to move detainees to Standish, MI. During the develop- 
ment of the Media Monitoring capability, OPS developed a Social Networking/Media 
Capability Analyst Handbook also known as a Desktop Binder. The purpose of the 
Desktop Binder was to serve as a desk reference for media monitoring analysts. In 
an early draft version of the Desktop Binder, an example was created based on ac- 
tual information related to citizens’ opinions regarding moving Guantanamo Bay 
Detainees to Standish, MI. This document was part of a “weekly report example,” 
not an actual report in a very early, and obsolete version of the Desktop Binder. 
This version of the Desktop Binder was created while OPS was still in the midst 
of developing its media monitoring processes, and before the media monitoring re- 
ports were ever distributed. This example has been removed from the Desktop Bind- 
er, and this information was never released through the situational awareness re- 
porting channels. 

To maintain a capability focused on reviewing incident and event information, 
OPS trains analysts to review information in compliance with the parameters set 
forth in the Privacy Impact Assessments (PIAs). During the report production proc- 
ess, reports are reviewed multiple times to ensure PII is not inadvertently included. 
Reports are reviewed at least twice, once by the analyst generating the report and 
then again by the analyst’s counterpart. Each report is then checked by the media 
monitoring lead prior to dissemination. All reports distributed during each 24-hour 
period are checked by a media monitoring capability senior reviewer, and the media 
monitoring capability’s quality control leads conduct weekly reviews of all distrib- 
uted reports to ensure any inadvertent PII inclusions are identified and corrective 
action is taken. As described previously, the Privacy Office conducts Privacy Compli- 
ance Reviews every 6 months to ensure OPS is complying with the PIAs. 

Question 3. Please explain the terms of the contract and the rationale for con- 
tracting with General Dynamics to conduct social media situational awareness re- 
porting. 

Answer. To fulfill the National Operations Center’s (NOC) statutory responsibility 
to provide situational awareness, the NOC examines publicly available traditional 
and social media, compares it with many other sources of information, and includes 
it where appropriate into NOC reports. At the time the contract was awarded, the 
Office of Operations Coordination & Planning (OPS) did not have available Federal 
employees to complete this task. OPS procured contracted services to fulfill this 
function. Additionally, OPS has not ascertained if this service will be required on 
a permanent basis, making it more economical to utilize contractor services in the 
interim. 

OPS is continuing to assess current performance to determine the most efficient 
and effective mechanism for performing the media monitoring function in light of 
operational needs and budgetary direction. 

The Media Monitoring contract was competed for and awarded to General Dynam- 
ics Advanced Information Systems (GDAIS) on May 27, 2010, under the GSA Mis- 
sion Oriented Business Integrated Services (MOBlS) contract vehicle. The Period of 
Performance (POP) for this contract is July 1, 2010 through December 31, 2014, and 
the total contract value is $11.3 million. The contract includes tasks to monitor open 
sources for incidents relating to potential and emerging threats and hazards to the 
homeland. 

In accordance with the Federal Acquisition Regulation, the award to GDAIS was 
based on the Evaluation Team’s review and assessment of the qualifications of mul- 
tiple vendors that submitted a quotation in response to the Request for Quotation 
(RFQ). The Evaluation Team made a recommendation to the Source Selection Au- 
thority (SSA) that GDAIS offered the best value quote for fulfilling the Depart- 
ment’s social media situational awareness reporting requirement. After a thorough 
review of the Evaluator’s assessment which included an evaluation of the strengths, 
weaknesses, and risks of the quotes received, the SSA determined that GDAIS 
would provide superior performance of the Government’s objectives, and was the 
most technically competent contractor that had submitted a quotation. 
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Question 4. Please describe the way that DHS solicited feedback from the privacy 
community regarding DHS’ use of social media. 

Answer. In addition to the five Privacy Impact Assessments (dealing with the 
three pilots, the program, and the update to include seven narrow categories of per- 
sonally identifiable information) and three Privacy Compliance Reviews, the DHS 
Privacy Office has engaged in dialogue with the privacy community regarding DHS’ 
use of social media in a number of ways. These include several quarterly advocate 
outreach meetings (Privacy Information for Advocates), Chief Privacy Officer Testi- 
mony before the Data Privacy and Integrity Advisory Committee (DPIAC) in public 
meetings, DHS Privacy Office staff testimony before the DPIAC, and inter-agency 
and intra-agency discussions. The Privacy Impact Assessments and other docu- 
mentation are available at www.dhs.gov / privacy . 

The Chief Privacy Officer invites privacy organizations and privacy advocates 
(who have requested to participate) to quarterly informational meetings during 
which the Chief Privacy Officer provides updates on DHS privacy issues. To date, 
24 distinct organizations have requested invitations. The quarterly Privacy Informa- 
tion for Advocates meetings allow the Chief Privacy Officer and privacy advocates 
to discuss privacy issues that impact DHS and individuals. In 2010 and 2011, Chief 
Privacy Officer Mary Ellen Callahan spoke in depth about DHS’s use of social media 
and the situational awareness initiative at four of the quarterly meetings. Addition- 
ally, the March 2012 Privacy Information for Advocates meeting provided an oppor- 
tunity to update advocates on the social media situational awareness initiative at 
length, including discussing examples, as well as clarifying misconceptions. 

The DPIAC was established by the Secretary of Homeland Security as a discre- 
tionary committee under the Federal Advisory Committee Act to provide advice to 
the Secretary and to the DHS Chief Privacy Officer, upon request, on policy, pro- 
grammatic, operational, administrative, and technological issues within DHS that 
relate to personally identifiable information, as well as data integrity and other pri- 
vacy-related matters. Committee members are individuals from the private sector, 
academia, non-governmental organizations, and State government who have exper- 
tise in privacy, security, and emerging technologies. 

The DPIAC holds several public meetings throughout the year to receive updates 
from the DHS Privacy Office, learn more about how DHS components have imple- 
mented privacy, and gain information on specific DHS programs that have privacy 
implications. In 2010 and 2011, Chief Privacy Officer Mary Ellen Callahan provided 
public testimony on the development, progression, and modification of the social 
media situational awareness initiative at four of these meetings. Additionally, DHS 
Privacy Office staff publicly testified at DPIAC meetings on the social media situa- 
tional awareness initiative. In September 2010, one of the Associate Directors for 
Privacy Compliance testified on the development of Privacy Compliance Reviews 
generally, and how public Privacy Compliance Reviews focusing on the social media 
situational awareness initiative function. In March 2011, another Associate Director 
for Privacy Compliance publicly testified on the social media situational awareness 
initiative, focusing on the addition of the seven narrow categories of personally iden- 
tifiable information that would be collected. Finally, in December 2011, staff from 
the National Operations Center (NOC), which runs the social media situational 
awareness initiative, was scheduled to publicly testify on the social media situa- 
tional awareness initiative and the associated Privacy Compliance Reviews. How- 
ever, the testimony was postponed due to extended deliberations by the DPIAC on 
pending recommendations from the committee to the Department. Information 
about DPIAC, and the publicly available meetings, can be found at www.dhs.gov/ 
privacy. 

Throughout 2010-2012, the DHS Privacy Office also provided information about 
DHS’ use of social media, whether for public communications and outreach, situa- 
tional awareness, or operational use, to interagency privacy groups, including the 
Innovation and Emerging Technologies Subcommittee of the CIO Council Privacy 
Committee. These briefings were provided as examples of ways to embed privacy 
protections in Government use of social media generally, including developing Pri- 
vacy Impact Assessments and System of Records Notices as necessary. 

In addition to providing information via interagency fora, in 2011, the DHS Pri- 
vacy Office hosted an intra-agency privacy compliance meeting where staff from the 
National Operations Center updated DHS Component Privacy Officers on the social 
media situational awareness initiative and corresponding Privacy Compliance Re- 
views, as well as fielded questions from the Component Privacy Officers about the 
initiative. 

Question 5. Please explain who/what determines what the NOC looks at and 
searches for on social media sites. 
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Answer. The Senior Watch Officer (SWO) within the National Operations Center 
(NOC), as guided by the Privacy Impact Assessments (PIAs), determines the NOC’s 
search parameters. There are 13 broad Items of Interest (iOl) that focus analysts’ 
efforts when searching publicly available social media sites. The IOI categories pro- 
vide a general framework for the NOC’s searches. The following are the categories: 

(1) terrorism (includes media reports on the activities of terrorist organizations 
in the United States and abroad); 

(2) weather/natural disasters, emergency management (includes all-hazard re- 
ports, such as reports on hurricanes, tornadoes, flooding, and earthquakes); 

(3) fire (includes reports on the ignition, spread, response, and containment of 
wildfires, industrial fires, and explosions); 

(4) trafficking/border control issues (includes reports on the trafficking of nar- 
cotics, people, weapons, and goods into and out of the United States); 

(5) immigration (includes reports on apprehension of illegal immigrants and 
border control events or incidents ); 

(6) HAZMAT (includes reports on chemical, biological, and radiological haz- 
ardous materials discharges); 

(7) nuclear (includes reports terrorist attempts to obtain nuclear materials, se- 
curity incidents at nuclear facilities, and potential threats to nuclear facilities); 

(8) transportation security (includes reports on security breaches and incidents 
or threats involving rail, air, road, and water transit); 

(9) infrastructure (includes reports on attacks or failures in transportation net- 
works, telecommunications networks, energy grids, utilities, domestic food and 
agriculture, Government facilities, and financial infrastructure); 

(10) National and international security (includes reports relating to threats 
against American citizens, political figures, military installations, embassies, 
and consulates); 

(11) National and international health concerns (includes reports on outbreaks 
of infectious diseases and recalls of food or other items dangerous to public 
health); 

(12) public safety (includes reports on public safety incidents, building 
lockdowns, bomb threats, mass shootings, and building evacuations); and 

(13) cybersecurity (includes reports on cybersecurity matters such as cyber at- 
tacks, computer viruses, and the use of technology for terrorism purposes). 

There were originally 14 IOI categories. IOI 14 was “Reports on DHS, Compo- 
nents, and other Federal agencies: Includes both positive and negative reports on 
FEMA, CIS, CBP, ICE, etc. as well as organizations outside of DHS.” This IOI has 
been subsequently eliminated in order to prevent misunderstandings about the in- 
tended use of this information. 

Analysts conduct searches using publicly available streaming media and news- 
based search engines. These tools allow analysts to search by keyword or a collec- 
tion of terms. The keywords and terms that inform searching are pre-loaded onto 
the publicly available search tools. The core social media websites utilized by the 
NOC are listed in Appendix A of the January 6, 2011 Privacy Impact Assessment 
that is available to the public via www.dhs.gov / privacy. The core search terms, or 
keywords, utilized by the NOC are listed in Appendix B of the same publicly avail- 
able document. 
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